Our responsibility to protect your health information
Prime Metabolic LLC is required to protect the privacy of your PHI, provide this Notice of Privacy Practices, follow the privacy practices described here while they are in effect, and notify affected individuals when a reportable breach of unsecured PHI occurs.
What you have the right to do
You may contact our Privacy Officer to exercise any of the rights below.
Access Your Records
You may inspect or request a copy of health information maintained in a designated record set, including medical history, treatment notes, and prescription records. Electronic copies will be provided in a reasonably producible format when available. A reasonable cost-based fee may apply where permitted.
Request Corrections
If you believe information in your record is inaccurate or incomplete, you may ask us to amend it. We may deny a request in circumstances permitted by law, and if we do, we will provide an explanation.
Accounting of Disclosures
You may request an accounting of certain disclosures of your PHI made during the six years preceding your request, excluding disclosures such as those made for treatment, payment, or healthcare operations when HIPAA does not require them to be listed.
Request Restrictions
You may ask us to limit certain uses or disclosures of your PHI. We are not always required to agree, except in situations where HIPAA requires a restriction, including certain disclosures to a health plan for services paid in full out-of-pocket.
Confidential Communications
You may ask us to contact you in a particular way or at a particular location. We will accommodate reasonable requests when required by law.
Copy of This Notice
You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.
How we may use your information
HIPAA permits us to use or disclose PHI for certain purposes without obtaining a separate written authorization. Other uses and disclosures require authorization unless otherwise permitted or required by law.
Permitted without your authorization
We may use and share PHI to provide, coordinate, and manage your care, including licensed provider review, prescription coordination, medication fulfillment, and communication with other licensed providers involved in your treatment.
We may use PHI for billing, collections, eligibility or authorization activities, and other payment-related functions. Prime Metabolic's current service model should be reviewed periodically so this description remains accurate.
We may use PHI for quality improvement, clinical operations, staff training, compliance, auditing, and business planning subject to appropriate safeguards.
We may disclose PHI when federal, state, or local law requires us to do so, including legally required reporting and oversight activities.
We may make disclosures for legally authorized public-health functions, including disease control, safety reporting, and medication-related adverse-event reporting.
Where permitted by law, PHI may be disclosed when necessary to prevent or lessen a serious and imminent threat to health or safety.
Research uses are limited to circumstances allowed under HIPAA, such as appropriately authorized research, approved waivers, or certain de-identified or limited data sets with required safeguards.
HIPAA permits certain disclosures for specialized government functions when applicable, such as national security, military or veterans' activities, or correctional-institution functions.
Uses requiring your authorization
Written authorization is generally required for uses or disclosures not otherwise permitted by HIPAA, including certain marketing activities, sale of PHI, and most uses of psychotherapy notes. You may revoke an authorization in writing, subject to actions already taken in reliance on it.
Prime Metabolic does not sell your health data. PHI should not be sold, rented, or traded to data brokers or advertisers for commercial use.
Our duties under HIPAA
- Maintain the privacy and security of PHI as required by applicable law.
- Follow the duties and privacy practices described in the current Notice.
- Provide this Notice and make a copy available upon request.
- Provide legally required breach notifications when unsecured PHI is compromised.
- Use or disclose PHI only as permitted by this Notice, an authorization, or applicable law.
- Apply these privacy protections to PHI maintained by Prime Metabolic, regardless of its original source.
Changes to this Notice
Prime Metabolic may revise this Notice and may make a revised Notice effective for PHI already maintained as well as information received in the future, to the extent permitted by law. The current Notice should be posted on the website and made available on request.
How we protect your information
Prime Metabolic uses administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of PHI.
Administrative Safeguards
Policies, workforce training, designated privacy and security responsibilities, risk assessment, and access-management processes support the protection of PHI.
Technical Safeguards
Technical controls may include encryption in transit and at rest, role-based access, multi-factor authentication, session controls, logging, and audit capabilities. Confirm that every control listed publicly matches the production environment before publishing.
Physical Safeguards
Physical and workstation controls are used to reduce unauthorized access to systems and locations where PHI may be accessed or processed.
Business Associate Agreements
Vendors that create, receive, maintain, or transmit PHI on our behalf are required to enter into Business Associate Agreements when HIPAA requires one.
Your right to file a complaint
If you believe your privacy rights have been violated, you may submit a complaint to Prime Metabolic or to the U.S. Department of Health and Human Services Office for Civil Rights (OCR). Prime Metabolic will not retaliate against you for filing a complaint.
HHS OCR complaints may be submitted through the federal complaint process. Complaints generally must be filed within 180 days of when you knew, or reasonably should have known, about the act or omission at issue, subject to OCR's rules.
Visit HHS OCR →Questions & requests
To exercise a HIPAA right, request a restriction, report a concern, or request a paper copy of this Notice, contact Prime Metabolic's Privacy Officer.