HIPAA Notice of Privacy Practices

1. About this notice

This notice applies to all health information created or received by Elevate IV Solutions, our registered nurses, our supervising physician, and our administrative staff, in every setting where we treat you — your home, office, hotel, or an event.

2. What is protected health information

Protected health information (PHI) is individually identifiable information about your health, your care, or payment for your care. For our practice, that includes your medical history, medications, allergies, the Good Faith Exam your nurse performs, the treatment you received, clinical observations during the visit, your signed consent, and billing records tied to that care.

Information that carries no health context — for example, signing up for our newsletter before you ever book — is covered by our Privacy Policy rather than this notice.

3. What we collect and when

Before any treatment, your nurse completes an intake and a Good Faith Exam. That involves collecting:

• Current and past medical conditions, including cardiac, kidney, and liver history
• All medications and supplements you take
• Allergies and any previous reaction to IV therapy, medications, or latex
• Pregnancy or breastfeeding status
• Vital signs taken at the visit
• The treatment administered, dose, site, lot numbers, and how you tolerated it
• Your signature on the consent form

We collect this because it determines whether treatment is safe for you — not for marketing, and not because it is nice to have.

4. How we may use and disclose your PHI

HIPAA permits us to use and disclose your health information without separate authorization for the following:

Treatment

To provide and coordinate your care. For example, the nurse assigned to your visit reviews your intake before arriving; our supervising physician reviews a history that requires clinical judgment; and if you ask, we send records to your primary care provider.

Payment

To bill and collect for services. For example, processing your card, applying a membership or credit balance, or preparing a superbill you requested for possible insurance reimbursement.

Health care operations

To run the practice safely and well — quality review of clinical documentation, nurse training and competency evaluation, licensing and accreditation, and business planning. Where possible we use de-identified or aggregate data for these purposes.

Appointment reminders and care communications

To send you confirmations, arrival ETAs, tracking links, aftercare instructions, and follow-up messages about a visit. These may be sent by text, push notification, email, or voicemail to the contact information you gave us. Tell us if you prefer a different method or want us to avoid a particular channel.

Individuals involved in your care

To share relevant information with a family member, guardian, or friend you identify as involved in your care or payment. If you are present and able to decide, we ask you first. If you are incapacitated, we use professional judgment about what is in your best interest.

As required by law

• Public health reporting, including communicable disease and adverse event reporting to the FDA
• Reporting suspected abuse, neglect, or domestic violence
• Health oversight activities such as licensing board audits and investigations
• Judicial and administrative proceedings, in response to a valid subpoena or court order
• Law enforcement requests that meet HIPAA's specific requirements
• To avert a serious and imminent threat to the health or safety of you or another person
• Workers' compensation claims, to the extent authorized by Arizona law
• Coroners, medical examiners, and funeral directors as permitted

5. Uses that require your written authorization

We will not do any of the following without your signed authorization:

• Use or disclose your PHI for marketing purposes
• Sell your PHI — we do not sell health information under any circumstances
• Use your photo, name, or story in advertising or on social media
• Disclose psychotherapy notes, in the rare case any exist
• Any other use not described in this notice

You may revoke an authorization in writing at any time. Revocation stops future use but cannot undo disclosures we already made in reliance on it.

6. Your rights over your health information

7. How to exercise your rights

Email jennifer@elevateivsolutions.com, call (480) 392-8827, or write to us at the address below. Requests for access, amendment, or an accounting should be in writing so we have a clear record of what you asked for.

We verify your identity before releasing anything. There is no charge to inspect your record; we may charge a reasonable, cost-based fee for copies, and we will tell you the amount before we produce them.

We will never retaliate against you for exercising any of these rights.

8. Our legal duties

We are required by law to:

• Maintain the privacy and security of your protected health information
• Give you this notice of our legal duties and privacy practices
• Follow the terms of the notice currently in effect
• Notify you promptly if a breach compromises the privacy or security of your information
• Apply the minimum necessary standard — using or disclosing only what is needed for the purpose at hand

9. Safeguards we have in place

Administrative

• HIPAA training for every employee and contractor, with signed confidentiality agreements
• Role-based access — staff can reach only the records their role requires
• A designated Privacy Officer responsible for compliance and complaints
• Business Associate Agreements with every vendor that touches PHI

Physical

• Paper consents are secured in transit and digitized promptly, then destroyed securely
• Devices used in the field are passcode-protected and remotely wipeable
• Sharps and any labeled materials are transported and disposed of under medical waste protocol

Technical

• TLS encryption for all data in transit
• Field-level encryption at rest for sensitive intake fields and signatures
• Authenticated, logged access to the admin and provider applications
• Card data handled exclusively by a PCI-compliant processor and never stored by us

10. Business associates

Some vendors handle PHI on our behalf — our CRM and scheduling platform, our messaging providers, our payment processor, and our hosting provider. Each is bound by a Business Associate Agreement requiring them to safeguard your information to the same standard we do and to use it only for the services they provide us.

11. Breach notification

If unsecured PHI is breached, we will notify affected individuals without unreasonable delay and no later than 60 days after discovery. The notice will describe what happened, what information was involved, the steps we are taking, and what you can do to protect yourself. Larger breaches are also reported to the U.S. Department of Health and Human Services and, where required, to the media.

12. How to file a complaint

If you believe your privacy rights have been violated, tell us first — email jennifer@elevateivsolutions.com and we will investigate.

You may also file directly with the federal government at no cost:

• Office for Civil Rights, U.S. Department of Health and Human Services
• 200 Independence Avenue SW, Washington, D.C. 20201
• 1-877-696-6775
• hhs.gov/hipaa/filing-a-complaint

You will not be penalized or refused service for filing a complaint.

13. Changes to this notice

We reserve the right to change this notice and to make the revised notice effective for health information we already hold as well as information we receive in the future. The current version is always posted here with its effective date, and a copy is available at any appointment on request.