1. Who is covered by this Notice
This Notice describes the privacy practices of Visitry, Inc. ("Visitry," "we," "us," or "our") with respect to Protected Health Information ("PHI") that we create, receive, maintain, or transmit in the course of providing healthcare services. "PHI" means individually identifiable health information about a patient, as defined by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations.
Visitry operates in two capacities that may each be subject to HIPAA:
- Direct clinic services. Where Visitry provides therapy directly under its own clinic license (for example, our mobile outpatient therapy line), Visitry acts as a Covered Entity under HIPAA.
- Staffing and network services. Where Visitry supplies contracted clinicians to home-health agencies that are themselves Covered Entities, Visitry typically acts as a Business Associate of those agencies, and our handling of PHI is governed by the Business Associate Agreement in place with the agency as well as by HIPAA.
This Notice addresses Visitry's practices in both capacities. Where a particular right or obligation depends on that distinction, we note it.
2. Our legal duties
Visitry is required by law to:
- Maintain the privacy and security of your PHI.
- Provide you with this Notice describing our legal duties and privacy practices with respect to PHI.
- Abide by the terms of the Notice currently in effect.
- Notify you if a breach of your unsecured PHI occurs.
3. How we may use and disclose PHI
We may use and disclose your PHI for the following purposes without additional authorization from you:
3.1 Treatment
We may use and disclose PHI to provide, coordinate, or manage your healthcare. For example, we may share your visit information with the clinician assigned to your care, with other clinicians in your care plan (such as a PTA following up after a PT's evaluation), and with the referring home-health agency.
3.2 Payment
We may use and disclose PHI to obtain payment for services and for activities related to payment. Examples include preparing and submitting invoices to a referring agency, tracking visit completion for contractor compensation, and providing information to third parties for billing and reimbursement purposes.
3.3 Healthcare operations
We may use and disclose PHI for healthcare operations — activities that are necessary to run our services and ensure quality care. Examples include credentialing clinicians, quality improvement, scheduling, compliance audits, and evaluating clinician performance.
3.4 Business associates
We work with service providers (for example, our database host, cloud storage vendor, e-signature vendor, and AI document-validation provider) that may have access to PHI as part of delivering services to us. We have written Business Associate Agreements with those providers that require them to protect PHI consistent with HIPAA. A list of the categories of service providers is maintained in our Privacy Policy, Section 5.
3.5 Required by law
We may use and disclose PHI when required by federal, state, or local law, including in response to subpoenas, court orders, and other legal process.
3.6 Public health and safety
We may disclose PHI, as permitted by law, to:
- Public health authorities for purposes such as disease reporting and surveillance.
- Appropriate government authorities to report suspected abuse, neglect, or domestic violence.
- Health oversight agencies for audits, investigations, and licensure activities.
- Law enforcement officials in limited circumstances defined by HIPAA.
- Coroners, medical examiners, and funeral directors in accordance with applicable law.
- Organizations involved in organ and tissue donation when authorized by law.
- Workers' compensation programs as authorized by law.
3.7 To prevent serious threats to health or safety
We may use or disclose PHI when necessary to prevent a serious and imminent threat to the health or safety of a person or the public.
3.8 Research and fundraising
Visitry does not currently conduct research on PHI or use PHI for fundraising. If this changes, we will update this Notice and obtain required authorizations.
4. Other uses that require your written authorization
Most uses and disclosures of PHI not described above will be made only with your written authorization. In particular, we will obtain your authorization before:
- Using or disclosing psychotherapy notes, if any are created.
- Using or disclosing PHI for marketing purposes.
- Selling PHI (Visitry does not sell PHI under any circumstances).
You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.
5. Uses that require an opportunity to object
When appropriate, we will give you an opportunity to agree or object to certain uses and disclosures, for example:
- Disclosing PHI to family members or caregivers involved in your care.
- Disclosing PHI in notification situations (e.g., informing a family member of your general condition or location).
If you are not present or able to object, we may use professional judgment and disclose PHI that we determine is in your best interest.
6. Your rights regarding your PHI
6.1 Right to access your PHI
You have the right to inspect and obtain a copy of the PHI we maintain about you in a designated record set. We will provide the copy in the form and format you request if it is readily producible, including electronic copies. We may charge a reasonable, cost-based fee for copies consistent with applicable law.
6.2 Right to request amendment
You have the right to request that we amend PHI we maintain about you if you believe it is incorrect or incomplete. We may deny your request under certain circumstances allowed by law, in which case we will provide a written explanation of our decision and your rights.
6.3 Right to an accounting of disclosures
You have the right to request an accounting of certain disclosures of your PHI made by Visitry during the six years prior to the date of your request. The accounting will not include disclosures made for treatment, payment, or healthcare operations, nor disclosures made with your authorization.
6.4 Right to request restrictions
You have the right to request restrictions on certain uses and disclosures of your PHI for treatment, payment, and healthcare operations, and to individuals involved in your care. We are not required to agree to your request in most cases. However, we must agree to restrict disclosure to a health plan for payment or healthcare operations if you have paid out-of-pocket in full for the item or service involved.
6.5 Right to request confidential communications
You have the right to request that we communicate with you about your PHI by alternative means or at alternative locations. We will accommodate reasonable requests.
6.6 Right to a paper copy of this Notice
You have the right to obtain a paper copy of this Notice at any time, even if you agreed to receive it electronically. To request a paper copy, contact our Privacy Officer using the information below.
6.7 Right to choose someone to act for you
If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. We will verify the person's authority before acting.
7. Breach notification
We are required to notify you, in accordance with HIPAA's Breach Notification Rule, of a breach of unsecured PHI affecting you. We may also be required to notify the U.S. Department of Health and Human Services and, in certain cases, the media. Where Visitry is acting as a Business Associate, we will notify the applicable Covered Entity in accordance with the Business Associate Agreement and will cooperate in any downstream notification.
8. Complaints
If you believe your privacy rights have been violated, you may file a complaint with Visitry's Privacy Officer using the information below, or with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. You can reach the Office for Civil Rights at:
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
1-877-696-6775
www.hhs.gov/ocr/privacy/hipaa/complaints
We will not retaliate against you for filing a complaint.
9. Changes to this Notice
We reserve the right to change this Notice and to make the revised Notice effective for PHI we already maintain as well as PHI we receive in the future. The current Notice will always be available at this URL. We will post the revised Notice at least 10 business days before the effective date of any material change and, where required by law, provide notice through additional channels.
10. How to contact us
If you have any questions about this Notice, want to exercise any of the rights described above, or want to file a complaint, please contact:
Visitry, Inc. — Privacy Officer
802 E Whiting St
Tampa, FL 33602
United States
privacy@visitry.com
For suspected security incidents or breaches, please also contact security@visitry.com.