HIPAA Notice

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective date: September 16, 2026

This Notice of Privacy Practices applies to HarvardCare Home Health and its workforce when providing and administering home health services, including physical therapy. Protected health information, or PHI, is identifiable information about health, care, or payment for care that is protected by HIPAA. Additional federal or California protections may apply to particular records.

1. Our responsibilities

We are required by law to maintain the privacy of PHI, provide this notice of our legal duties and privacy practices, follow the notice currently in effect, and notify affected individuals after a breach of unsecured PHI as required by law. We must protect health information using the safeguards required by applicable law.

2. Treatment, payment, and healthcare operations

Subject to applicable law, we may use and disclose PHI without a separate written authorization for these purposes:

• Treatment: planning and providing care and coordinating with other treating professionals. For example, a physical therapist may discuss your mobility assessment and care plan with the clinician who ordered home health services.
• Payment: checking eligibility, obtaining required authorizations, submitting claims, and reviewing payment. For example, an insurer may receive information about the services provided and why they were medically necessary.
• Healthcare operations: managing care, reviewing quality and safety, conducting appropriate training, auditing, and administering the agency. For example, an authorized clinical supervisor may review records to evaluate whether care follows the plan.

Service providers that handle PHI on our behalf must meet applicable business associate requirements. We may also contact you about visits, treatment alternatives, or relevant care-related services when permitted by law.

3. Family, caregivers, and your preferences

When permitted, we may share information relevant to the involvement of a family member, friend, caregiver, or another person helping with your care or its payment. You may tell us whom to include or object to sharing. If you cannot express a preference, a clinician may use professional judgment to make a permitted disclosure in your best interests. Similar rules can apply to disaster-relief coordination.

A personal representative with legally recognized authority may exercise rights for you. We verify the person’s authority and its scope, subject to applicable exceptions designed to protect you.

4. Other uses and disclosures allowed by law

We may use or disclose PHI for the following purposes only when the conditions and limits of applicable law are met:

• Required reporting and compliance with federal, state, or local law, including an HHS compliance investigation.
• Public health activities, safety reporting, and legally authorized reports of abuse, neglect, or domestic violence.
• Health oversight, such as licensing reviews, inspections, audits, and investigations.
• Judicial or administrative proceedings and law-enforcement requests that satisfy the applicable legal requirements. A request alone does not always permit disclosure.
• Research under an authorization, waiver, or another legally permitted basis.
• Organ or tissue donation and the duties of coroners, medical examiners, or funeral directors.
• Prevention or reduction of a serious and imminent threat to health or safety, consistent with law.
• Workers’ compensation and authorized specialized government functions, including certain military, national-security, and correctional matters.

5. Records with additional protections

California’s Confidentiality of Medical Information Act and other laws can impose more restrictive rules than HIPAA, including for certain mental health, HIV-related, genetic, and other sensitive information. Where an additional authorization or a narrower disclosure is required, those protections apply. The general permissions above do not override them.

Substance use disorder records: if we receive or maintain records protected by 42 CFR Part 2, those records receive the additional protections required by that law. They may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you without the specific written consent required by Part 2 or a qualifying court order accompanied by a subpoena or other legally required compulsion. A general treatment, payment, or operations consent is not permission to use those records in proceedings against you.

Information disclosed to a recipient outside HIPAA may no longer be protected by HIPAA. Other protections, including Part 2 restrictions where applicable, may continue to apply.

6. Authorization, marketing, and fundraising

Uses and disclosures not permitted by law or described in this notice require your written authorization. Most uses or disclosures of psychotherapy notes, marketing uses requiring authorization, and a sale of PHI requiring authorization need your written permission. You may revoke an authorization in writing, except to the extent action has already been taken in reliance on it or another legal exception applies.

A website visit, general contact request, acceptance of website terms, or cookie choice is not a HIPAA authorization. If fundraising communications are sent as permitted by law, you may opt out of further fundraising contacts; your choice will not affect treatment or payment. Before Part 2 information is used for fundraising, you must receive a clear opportunity to choose not to receive those communications.

7. Your rights and how to use them

Inspect or obtain records

You may request access to medical, billing, and other records in the designated record set used to make decisions about you, subject to limited legal exceptions. Ask for inspection, a paper copy, or an available electronic copy in the requested format. A summary is provided instead only if you agree. Any fee must be permitted by law.

Requests are handled within the applicable deadline. HIPAA generally requires action within 30 calendar days and permits one additional 30-day extension with timely written reasons and a completion date; a shorter California deadline applies where required. If access is denied, you will receive the required explanation and information about any review or complaint rights.

Request a correction

You may ask us to amend information you believe is inaccurate or incomplete and explain the reason. We may deny an amendment in the circumstances allowed by law, but must explain the denial and any right to submit a statement of disagreement. HIPAA generally requires action within 60 days, with a permitted extension of up to 30 days and written notice.

Ask for restrictions

You may ask us to restrict uses or disclosures for treatment, payment, or operations, or disclosures to people involved in your care. We are not required to accept every requested restriction. We must accept a qualifying request not to disclose an item or service to a health plan for payment or operations when you or someone other than that plan paid for it in full out of pocket, unless disclosure is required by law. Tell us about the request before a claim or disclosure is made.

Request confidential communications

You may ask us to contact you by a particular method or at another location, such as a different mailing address or phone number. We will accommodate reasonable requests as required by law.

Receive an accounting of disclosures

You may request a list of disclosures covered by the accounting right for a period of up to six years before the request. Exceptions include many treatment, payment, and operations disclosures and disclosures made with your authorization. The first accounting in a 12-month period is free; a permitted fee may apply to additional requests after notice and an opportunity to modify or withdraw the request.

Obtain a copy and raise concerns

You may request a paper copy of this notice even if you previously agreed to receive it electronically. You may also ask questions, exercise your rights through an authorized representative, and complain without retaliation.

8. Privacy contact and complaints

Contact our office and ask for the Privacy Officer to exercise a right, request a form or paper notice, revoke an authorization, or file a complaint. Some requests must be in writing; we can explain the applicable process and verify identity or representative authority.

HarvardCare Home Health
511 E Harvard St, Suite 6
Glendale, CA 91205

Phone: (323) 484-4440
Fax: (818) 450-0733
Email: harvardcarehomehealth@gmail.com

For privacy requests, ask for the Privacy Officer. Use email to request assistance or arrange a protected way to communicate; do not include medical records, insurance member numbers, Social Security numbers, or other sensitive details in ordinary email.

You may also complain directly to the U.S. Department of Health and Human Services, Office for Civil Rights. You do not need our permission or have to complain to us first. We will not retaliate against you for filing a complaint.

9. Changes to this notice

We may revise this notice as permitted by law and make the revised terms apply to PHI we already hold as well as information received later. The revised notice will display its effective date and be available through this website and from the office. A paper copy is available on request.

For website-specific information, read our Privacy Policy and Cookie Policy. Learn more about privacy notices from HHS.