This Notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
1. Who we are
EvokeMD ("EvokeMD," "we," "us," "our") is a healthcare technology company that facilitates access to licensed healthcare providers for telehealth consultations and telehealth care for weight management, general wellness, healthy aging and sexual wellness. We are committed to protecting the privacy of our patients ("you," "your") and complying with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and applicable state privacy laws.
Privacy Officer: contact us through our Contact page or email support@evokemd.com.
2. Protected Health Information (PHI)
"Protected Health Information" (PHI) is individually identifiable health information that relates to your past, present or future physical or mental health, the provision of healthcare to you, or the payment for such care. PHI includes information in any form: written, electronic or oral.
We collect PHI that you provide, including:
- Name, date of birth, email address, phone number and mailing address
- Health history, current medications, allergies and lab results
- Consultation notes and treatment plans created by affiliated Providers
- Payment information processed by the payment provider selected for the Services
3. How we use and disclose PHI
We use and disclose your PHI only as permitted or required by law. Primary uses include:
- Treatment
- Sharing your PHI with affiliated Providers to facilitate your consultations and care coordination.
- Payment
- Sharing your PHI with payment processors and, where applicable, with payers, to process charges for services rendered.
- Healthcare operations
- Using PHI for quality improvement, auditing, compliance monitoring and Provider credentialing activities.
- Required by law
- Disclosing PHI when required by federal or state law, including to public health authorities, law enforcement (in limited circumstances) or the Department of Health and Human Services (HHS) for compliance investigations.
- Business Associates
- We may share PHI with vendors that support our operations, including patient communications and care coordination, subject to applicable legal and contractual safeguards.
We do not sell your PHI. We do not use your PHI for marketing purposes without your separate written authorization.
4. Your rights as a patient
You have the following rights regarding your PHI:
- Right to access
- You may request a copy of your PHI held by EvokeMD or affiliated Providers. Requests will be fulfilled within 30 days. We may charge a reasonable fee for copies.
- Right to amend
- If you believe PHI in your record is incorrect or incomplete, you may request an amendment. We may deny the request if we determine the record is accurate.
- Right to an accounting of disclosures
- You may request a list of disclosures of your PHI made by EvokeMD, other than disclosures for treatment, payment or healthcare operations.
- Right to request restrictions
- You may request restrictions on how we use or disclose your PHI. We are not always required to agree to your request, but we will consider it.
- Right to confidential communications
- You may request that we contact you in a specific way (for example, by email only) or at a specific location.
- Right to receive this Notice
- You have the right to receive a paper copy of this Notice upon request.
To exercise any of these rights, contact our Privacy Officer through our Contact page.
5. Data security
We use administrative, physical and technical safeguards designed to protect PHI from unauthorized access, use or disclosure, which may include:
- Safeguards for PHI during transmission and storage
- Access controls limiting PHI access to authorized personnel
- Audit logs tracking access to and modifications of PHI
- Appropriate agreements with service providers that handle PHI
6. Breach notification
In the event of a breach of unsecured PHI, we will notify affected individuals without unreasonable delay and within 60 days of discovery, as required by HIPAA's Breach Notification Rule. Notification will include a description of the breach, the types of information involved, steps you should take to protect yourself and steps we are taking to investigate and mitigate the breach.
7. Retention
We retain PHI for a minimum of seven (7) years from the date of service, or as otherwise required by applicable state law. When PHI is no longer needed, it is securely destroyed.
8. How to file a complaint
If you believe your privacy rights have been violated, you may file a complaint with:
- EvokeMD Privacy Officer: our Contact page
- U.S. Department of Health and Human Services, Office for Civil Rights: hhs.gov/hipaa/filing-a-complaint
You will not be retaliated against for filing a complaint.
9. Changes to this Notice
We reserve the right to change the terms of this Notice at any time. Updated versions will be posted on this page and will apply to all PHI we maintain. If we make a material change, we will notify you by email.
This page provides general information and is not medical advice.
