Effective Date: June 2, 2026

​

​

Our practice, Integrated Care Physicians, PLLC d/b/a HarborWell Health ("HarborWell Health"), is managed by HarborWell Health, LLC,  and is required by law to provide you with this notice of privacy practices (Notice) under the federal privacy and security requirements known as HIPAA.

 

This Notice applies to all PHI created, received, maintained, or transmitted by HarborWell Health, including in connection with our clinical care coordination, telehealth, patient portal, and managed care services.

 

1. How We May Use and Disclose Your Health Information

The following describes the ways HarborWell Health may use and disclose your PHI. Not every use or disclosure in a category will be listed, but all permitted uses and disclosures will fall within one of the following categories. We may store, use and disclose PHI in paper form or electronically.

 

1.1 Treatment

We may use and disclose your PHI for treatment purposes, including to provide, coordinate, or manage your healthcare and related services. This includes sharing information with physicians, nurses, specialists, and other members of your interdisciplinary care team  who are involved in your care. For example, we may share your diagnosis and care plan with a home health aide, physical therapist, or durable medical equipment provider participating in your care program.

 

1.2 Payment

We may use and disclose your PHI to obtain payment for services provided to you. This includes submitting claims to your Health Plan, verifying eligibility and benefits, and obtaining prior authorizations. For example, we may share your diagnosis codes and service records with your Health Plan to process a claim or confirm your enrollment in a care program.

 

1.3 Healthcare Operations

We may use and disclose your PHI for healthcare operations purposes. These activities are necessary to run our organization and ensure quality care. Examples include:

• Quality assessment, improvement activities, and population health management

• HEDIS measure performance and Health Plan Star rating programs

• Workforce training and clinical competency evaluation

• Accreditation, certification, and compliance audits (including SOC 2 Type II)

• Business planning and general administrative activities

• Conducting or arranging for legal, audit, and compliance reviews

 

1.4 Health Information Exchanges and Care Coordination

We may participate in health information exchanges (HIEs) and receive, use and disclose Admission, Discharge, and Transfer (ADT) notifications and other PHI to facilitate timely and coordinated care. These activities support our ability to monitor your health status, prevent unnecessary hospitalizations, and coordinate follow-up care.

 

1.5 Business Associates

We may disclose PHI to our business associates — vendors and service providers that perform functions on our behalf, including electronic health record platforms, telehealth providers, SMS messaging service providers, and cloud infrastructure providers. All business associates are required by law to protect your information under a Business Associate Agreement and to apply safeguards consistent with the HIPAA Security Rule.

 

1.7 Required by Law

We may use and disclose your PHI when required to do so by applicable federal, state, or local law, including Medicaid program requirements and mandatory reporting obligations and disclosures to the U.S. Department of Health and Human Services if it requests such information to determine that we are complying with HIPAA.

 

1.8 Public Health Activities

We may use and disclose your PHI for public health activities, including disclosing PHI to public health authorities for preventing or controlling disease, injury, or disability; reporting vital statistics; and reporting adverse events related to medications or medical devices.

 

1.9 Health Oversight Activities

We may disclose PHI to health oversight agencies — such as the Centers for Medicare & Medicaid Services (CMS), state Medicaid agencies, or state licensing boards — for oversight activities authorized by law, including audits, investigations, and inspections.

 

1.10 Judicial and Administrative Proceedings

We may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process, subject to applicable legal protections. If we have substance use disorder patient records about you that are subject to federal rules found at 42 CFR part 2, we cannot use or share information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without (1) your consent or (2) a court order and a subpoena.

 

1.11 Law Enforcement

We may disclose PHI to law enforcement officials for limited purposes, such as complying with a court order, warrant, or grand jury subpoena; identifying or locating a suspect; or reporting a crime on our premises.

 

1.12 Serious Threats to Health or Safety

We may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure is to a person or persons reasonably able to prevent or lessen the threat.

 

1.13 Decedents/Organ Donation

We may disclose PHI to a coroner, medical examiner, or funeral director as authorized or required by law, and to organ procurement organizations in appropriate circumstances. If you are an organ donor, we may release PHI to organizations that handle organ procurement or transplantation as necessary to facilitate organ or tissue donation and transplantation

 

1.14 Workers' Compensation

We may disclose your PHI to the extent authorized by and necessary to comply with laws relating to workers' compensation and other similar programs.

 

1.15     Abuse, neglect or domestic violence 

If we reasonably believe you have been a victim of abuse, neglect, or domestic violence, we may use or disclose your PHI to notify the appropriate government authority.

 

1.16 Research

We may use or disclose your PHI for research purposes, subject to the requirements of applicable law.

 

1.17 Limited Data and De-identified Data

We may remove most information that identifies you from a set of data and use and disclose this data set for research, public health and health care operations, provided the recipients of the data set agree to keep it confidential. We may also de-identify your PHI and use and disclose the de-identified information for purposes permitted by law.

 

1.18 Specialized Government Functions

To the extent permitted by law, we may use and disclose PHI for national security activities and intelligence and counterintelligence activities, to correctional institutions and to the military. 

 

1.19 Family/Friends

If you consent, do not object or we determine it is in your best interests, we may disclose PHI to your family or friends or any other individual involved in your care to the extent the PHI is directly related to such person's involvement in your care or the payment for your care. We may use or disclose your PHI to notify, or assist in the notification of, a family member, a personal representative, or another person responsible for your care, of your location, general condition, or death.

 

2. Uses and Disclosures That Require Your Authorization

The following uses and disclosures of your PHI will be made only with your authorization, unless otherwise permitted or required by law:

 

• Most uses and disclosures of psychotherapy notes

• Uses and disclosures for marketing purposes

• Disclosures that constitute a sale of PHI

• Any other use or disclosure not described in this Notice

 

You may revoke a written authorization at any time by submitting a written request to support@harborwellhealth.org. Revocation will not affect any actions we took in reliance on the authorization before we received your revocation.

 

3. Your Rights Regarding Your Health Information

You have the following rights with respect to your PHI. To exercise any of these rights, please submit a written request to support@harborwellhealth.org or by mail to: HarborWell Health, 3810 Bedford Ave, Suite 200, Nashville, TN 37215.

 

3.1 Right to Inspect and Copy

You have the right to inspect and obtain a copy of PHI that we maintain about you in a designated record set, which includes your medical and billing records. We will respond to your request within 30 days or such shorter period required by law (if applicable). We may charge a reasonable, cost-based fee for copies. We may deny your request in limited circumstances as permitted by law.

 

3.2 Right to Request Amendment

You have the right to request that we amend PHI about you that you believe is incorrect or incomplete. We will respond within 60 days. We may deny your request if the information was not created by us, is not part of the records we maintain, is not available for inspection under applicable law, or is accurate and complete.

 

3.3 Right to an Accounting of Disclosures

You have the right to request a list (accounting) of certain disclosures we have made of your PHI in the six years prior to your request. This right does not apply to disclosures for disclosures made directly to you; or disclosures made pursuant to your authorization; or certain other exceptions. We will respond within 60 days.

 

3.4 Right to Request Restrictions

You have the right to request that we restrict certain uses and disclosures of your PHI. We are not required to agree to your requested restriction except in one circumstance: if you request that we restrict disclosure of your PHI to a health plan for a service you paid for out of pocket in full, we must agree to that restriction. If we agree to a restriction, we will comply with that restriction unless the PHI is needed to provide emergency treatment.

 

3.5 Right to Request Confidential Communications

You have the right to request that we communicate with you about your health matters in a certain way or at a certain location. For example, you may ask that we contact you only by phone at a specific number or by mail to a specific address. We will accommodate all reasonable requests.

 

3.6 Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you have agreed to receive it electronically. To request a paper copy, contact us at support@harborwellhealth.org.

 

3.7 Right to Be Notified of a Breach

You have the right to be notified in the event that we (or a business associate) discover a breach of your unsecured PHI. Notice will be provided to you in accordance with HIPAA Breach Notification Rule requirements, which generally require notification within 60 days of our discovery of the breach.

​

4. Our Duties

HarborWell Health is required by law to:

• Maintain the privacy and security of your PHI

• Provide you with this Notice of our legal duties and privacy practices

• Abide by the terms of this Notice currently in effect

• Notify you following a breach of your unsecured PHI

 

We reserve the right to change the terms of this Notice at any time and to make the new provisions effective for all PHI we maintain. If we make material changes to this Notice, we will make the revised Notice available on our website and, where required, provide direct notice to affected individuals.

 

Electronic Communications and SMS

HarborWell Health’s default practice is to transmit PHI only through encrypted, HIPAA-compliant channels. PHI will not be sent to you via standard SMS or any other unencrypted protocol unless you have consented to that method after receiving and acknowledging disclosure of the security risks associated with unencrypted transmission. Standard SMS is not encrypted in transit and carries a risk that your health information could be intercepted or accessed by unauthorized parties. This consent may be revoked by you at any time by contacting support@harborwellhealth.org or by replying STOP to any SMS message. Consistent with HHS Office for Civil Rights guidance, HarborWell Health is not responsible for any disclosure of PHI that occurs during transmission where you have requested unencrypted delivery and have been advised of the associated risks.

​

5. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with HarborWell Health or with the U.S. Secretary of Health and Human Services. We will not retaliate against you for filing a complaint.

 

To file a complaint with HarborWell Health:

 

Email: support@harborwellhealth.org

Mail: HarborWell Health, Attn: Privacy Compliance

3810 Bedford Ave, Suite 200, Nashville, TN 37215

 

To file a complaint with the U.S. Department of Health and Human Services:

Office for Civil Rights, U.S. Department of Health and Human Services

200 Independence Avenue, S.W., Washington, D.C. 20201

Toll-free: 1-800-368-1019 | TDD: 1-800-537-7697

Website: https://www.hhs.gov/hipaa/filing-a-complaint

 

6. State Law and Additional Protections

When our operations are subject to laws (both federal and state) that are stricter or more protective requirements than HIPAA — including laws relating to mental health records, substance use disorder treatment, HIV/AIDS information, reproductive health, or genetic information — we comply with those stricter requirements.