Hinkapin Health | HIPAA Notice of Privacy Practices

1. Who this notice covers

Hinkapin Health LLC ("Hinkapin Health," "we," "us") works with self-funded employers, third-party administrators, benefits advisors and surgical facilities to coordinate bundled surgical care at published prices. Depending on which service you are receiving, our obligations under the Health Insurance Portability and Accountability Act ("HIPAA") differ. We are stating that plainly here rather than leaving it ambiguous.

In this role	Here is how your information is handled
As a business associate Most of our employer, TPA and advisor work	When we perform services for an employer's group health plan or its administrator, we act as that plan's business associate. The plan — not Hinkapin Health — is the covered entity, and the plan's own Notice of Privacy Practices governs your information. We handle your information only as permitted by our written Business Associate Agreement with that plan, and we are directly liable under HIPAA for safeguarding it. To exercise your HIPAA rights over information held in that context, contact your health plan administrator; we will support the plan in responding.
As, or on behalf of, a covered entity Care arranged through Affiliates	When you receive care at, or we arrange care through, our affiliated surgical facility, that facility is a covered entity under HIPAA and this notice describes how your information is used in that relationship. Sections 3 through 12 below apply to you directly.
Under Texas law, in every role	The Texas Medical Records Privacy Act (Texas Health & Safety Code, Chapter 181) defines "covered entity" far more broadly than federal HIPAA does — it reaches essentially any organization that collects, stores, analyzes, uses or transmits protected health information of a Texas resident. We treat ourselves as covered by Chapter 181 in all of our work, regardless of our federal HIPAA classification. Section 8 describes the additional rights that gives you.

If you are not sure which applies to you

Contact our Privacy Officer using the details in Section 12. If your information sits with your employer's health plan rather than with us, we will tell you that and point you to the right contact rather than leaving you to work it out.

2. What protected health information is

Protected health information ("PHI") is information that identifies you and relates to your physical or mental health, the health care you receive, or the payment for that care. In our work this typically includes your name and contact details, date of birth, the procedure you are scheduled for or considering, the surgeon and facility involved, your insurance or self-pay status, prior authorization and clearance records, and the amounts billed and paid.

It does not include information that has been de-identified in accordance with HIPAA standards — for example, the aggregate savings and volume figures we report to an employer, which contain no information that could reasonably identify any individual.

3. How we use and disclose your information

We may use and disclose your PHI without your written authorization for the following purposes.

Treatment

To coordinate and manage your surgical care. For example, we share your clinical clearance records with the operating surgeon and the anesthesia team, and we transmit your pre-operative instructions to the facility scheduling your procedure.

Payment

To determine what your care costs and to settle it. For example, we assemble the components of a bundled surgical episode — facility, surgeon, anesthesia, pathology, implants — into a single invoice, and we exchange eligibility and claims information with your health plan or its administrator so the episode can be paid correctly.

Health care operations

To run and improve our services. For example, we review outcomes and complication rates across episodes for quality assurance, we verify that participating surgeons and facilities hold current credentials, and we audit invoices against our published prices to confirm you were charged what was quoted.

To your employer's health plan

Where we act as a business associate, we return information to the plan or its administrator as our agreement requires. We do not disclose your individually identifiable health information to your employer as an employer. Information a plan sponsor receives is limited to what HIPAA permits — generally de-identified or summary information — unless you have separately authorized more.

Appointment, scheduling and financial communications

We may contact you by phone, text message or email about scheduling, pre-operative preparation, payment arrangements and follow-up. Tell us at any time if you prefer a different method or location, and see Section 7 on confidential communications.

4. Service providers and subcontractors

We use third-party technology providers to operate our forms, client portal, scheduling and communications. Where any of those providers may create, receive, maintain or transmit PHI on our behalf, we require a written Business Associate Agreement obligating them to safeguard your information to the same standard we are held to, and to report any breach to us. We do not sell your information, and we do not permit our vendors to use it for their own purposes.

5. Other permitted and required disclosures

Federal and state law allow or require us to use or disclose your PHI without your authorization in the following circumstances:

When required by law — including disclosures required by federal, state or local statute, regulation or court order.
Public health activities — reporting disease, injury, vital events, product defects or adverse events to authorities authorized to receive them.
Victims of abuse, neglect or domestic violence — to government authorities authorized to receive such reports.
Health oversight — to agencies conducting audits, investigations, inspections, licensure actions or civil, administrative and criminal proceedings.
Judicial and administrative proceedings — in response to a court or administrative order, or to a subpoena or discovery request where the required assurances have been given.
Law enforcement — in the limited circumstances HIPAA permits, such as identifying a suspect or reporting a crime on our premises.
Decedents — to coroners, medical examiners and funeral directors as necessary for them to carry out their duties.
Organ and tissue donation — to procurement organizations, where applicable.
Research — where an institutional review board or privacy board has approved a waiver of authorization and the required protocols are in place.
To avert a serious threat — to prevent or lessen a serious and imminent threat to the health or safety of you or others.
Specialized government functions — military and veterans activities, national security and intelligence, protective services, and correctional institutions.
Workers' compensation — as authorized by and to the extent necessary to comply with workers' compensation laws.

6. Uses that require your written permission

Other than the purposes described above, we will not use or disclose your PHI without your written authorization. Your written authorization is always required for:

Marketing communications, where we would receive payment from a third party for making them;
Any sale of your protected health information — and note that Texas law separately prohibits the sale of PHI except in narrow circumstances;
Psychotherapy notes, where they exist, with limited exceptions.

You may revoke an authorization in writing at any time. Revocation stops any future use or disclosure under that authorization but does not undo disclosures already made in reliance on it.

7. Your rights

You have the following rights regarding the protected health information we maintain about you. To exercise any of them, contact our Privacy Officer in writing using the details in Section 12. If we hold your information as a business associate of your health plan, we will route your request to the plan and support its response.

Get a copy of your health and claims records

You may inspect and obtain a copy of the information we hold about you, including an electronic copy where we maintain it electronically. We will respond within 30 days, or within 15 business days where Texas law's shorter deadline for electronic health records applies. We may charge a reasonable, cost-based fee.

Ask us to correct your records

If you believe information we hold is incorrect or incomplete, you may ask us to amend it. We may deny the request in certain circumstances, and if we do, we will explain why in writing and tell you how to submit a statement of disagreement.

Get a list of who we have shared your information with

You may request an accounting of certain disclosures we have made in the six years before your request. Disclosures for treatment, payment and health care operations, and those you authorized, are generally excluded. The first accounting in any 12-month period is free.

Ask us to limit what we use or share

You may request restrictions on how we use or disclose your information. We are not required to agree to every request — with one important exception described immediately below.

If you pay for your care yourself, in full

You have a right under 45 CFR 164.522(a)(1)(vi) to require that information about that care not be disclosed to your health plan for payment or health care operations purposes, and we must honor that request. Because a substantial share of our patients choose our published flat-rate pricing over billing insurance, this right applies frequently in our work. Tell us before your procedure and we will restrict the disclosure.

Ask us to contact you a different way

You may ask us to reach you at an alternative address, phone number or by an alternative method — for example, only at a personal mobile number rather than a work line. We will accommodate reasonable requests and will not ask you to explain why.

Get a paper copy of this notice

You may request a paper copy at any time, even if you agreed to receive it electronically. We will provide one promptly.

Be notified if your information is breached

We will notify you if a breach occurs that compromises the privacy or security of your information, as required by the HIPAA Breach Notification Rule and applicable Texas law.

Choose someone to act for you

If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise these rights on your behalf. We will verify their authority before acting.

8. Additional rights under Texas law

The Texas Medical Records Privacy Act (Texas Health & Safety Code, Chapter 181), as amended by House Bill 300, gives Texas residents protections beyond federal HIPAA. Where Texas law is more protective than HIPAA, we follow Texas law.

Faster access to electronic records. Where your records are maintained in an electronic health record system, you are entitled to a copy within 15 business days of a written request, rather than the 30 days federal law allows.
Notice of electronic disclosure. Texas Health & Safety Code § 181.154 requires that you be notified if your protected health information is subject to electronic disclosure. This notice, published on our website, serves as that notification. We may disclose your PHI electronically for treatment, payment and health care operations as described in Section 3. Electronic disclosure for any other purpose requires your separate written authorization, unless the disclosure is otherwise authorized or required by law.
No sale of your information. Texas law prohibits the sale of protected health information except in narrowly defined circumstances. We do not sell your information.
Trained workforce. Texas law requires that our workforce be trained on state and federal health information privacy law within 90 days of hire, and again when material changes in the law affect their duties. We maintain records of that training.
Enforcement. Chapter 181 is enforced by the Texas Attorney General and carries civil penalties independent of federal HIPAA enforcement.

9. Our responsibilities

We are required by law to maintain the privacy and security of your protected health information.
We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
We must follow the duties and privacy practices described in this notice and give you a copy of it.
We will not use or share your information other than as described here unless you tell us in writing that we may. If you tell us we may and then change your mind, you may revoke that permission in writing at any time.
We maintain administrative, physical and technical safeguards designed to protect your information, including access controls, encryption of data in transit and at rest, workforce training, and written agreements with every vendor that handles your information on our behalf.

10. Changes to this notice

We may change this notice, and the changes will apply to information we already hold as well as information we receive in the future. The current version will always be posted at hinkapinhealth.com/hipaa-notice.html with its effective date shown at the top. We will provide a copy on request.

11. Complaints

If you believe your privacy rights have been violated, you may complain to us, to the federal government, or to the State of Texas. We will not retaliate against you in any way for filing a complaint.

Complain to us *

Attn: Privacy Officer

Privacy Officer

Hinkapin Health LLC

3865 Childress Ave, Suite C
Mesquite, TX 75150

Email: concierge@hinkapinhealth.com

Phone: (888) 850-0711

Complain to the U.S. Department of Health and Human Services

Office for Civil Rights, U.S. Department of Health and Human Services
200 Independence Avenue SW, Room 509F, HHH Building, Washington, D.C. 20201
Phone: 1-877-696-6775 · Online: hhs.gov/hipaa/filing-a-complaint

Complain to the Texas Attorney General

Office of the Attorney General, Consumer Protection Division
PO Box 12548, Austin, TX 78711-2548
Phone: 1-800-621-0508 · Online: texasattorneygeneral.gov/consumer-protection

12. Who to contact

For any question about this notice, to exercise any of the rights described in Section 7, or to request a paper copy, contact our Privacy Officer: