Notice of Privacy Practices

Our Commitment to Your Privacy

Catamount Health Community Wellness Center, Inc. ("Catamount Health," "we," "us," or "our") understands that your health information is personal and sensitive. We are required by federal law, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH), as well as Vermont state health privacy statutes (18 V.S.A. Chapter 221), to maintain the privacy of your Protected Health Information (PHI), to provide you with this Notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect.

Zero Third-Party Data Selling Guarantee: Catamount Health will never sell, rent, lease, or trade your personal health information or any identifying data to third parties for marketing, advertising, data brokerage, or any commercial purpose. This guarantee applies to all patient data, financial records, and demographic information collected in the course of providing care.

How We Use and Disclose Your Health Information

The following categories describe the ways in which we may use and disclose your PHI without your specific written authorization, as permitted by HIPAA:

• Treatment: We may use your health information to provide, coordinate, and manage your healthcare and related services. This includes sharing relevant clinical information with other healthcare providers involved in your care, such as specialists, laboratories, pharmacies, and hospitals, to ensure continuity and quality of treatment.
• Payment: We may use and disclose your PHI to bill and receive payment for services provided. This includes submitting claims to your health insurance plan, verifying eligibility and coverage, obtaining prior authorizations, and coordinating benefits between multiple payers.
• Healthcare Operations: We may use your information for operational purposes including quality improvement activities, compliance audits, staff training and credentialing, patient satisfaction surveys, and accreditation processes (such as NCQA Patient-Centered Medical Home certification).
• Public Health Activities: As required by law, we may disclose PHI to public health authorities for purposes of disease surveillance, vital statistics reporting, and communicable disease control, in accordance with Vermont Department of Health reporting requirements.
• Health Oversight Activities: We may disclose PHI to health oversight agencies, such as the Vermont Department of Health and the Centers for Medicare and Medicaid Services (CMS), for audits, investigations, inspections, and licensure activities authorized by law.
• Judicial and Administrative Proceedings: We may disclose PHI in response to a valid court order, subpoena, or other lawful process, subject to the protections and limitations established by HIPAA and Vermont law.
• Law Enforcement: In limited circumstances, we may disclose PHI to law enforcement officials as required by law, such as reporting certain injuries, wounds, or suspected criminal activity on our premises.
• Disaster Relief: We may share PHI with authorized disaster relief organizations to coordinate notification of family members or others involved in your care during emergency situations.

Your Rights Regarding Your Health Information

Under HIPAA and Vermont law, you have the following rights with respect to your Protected Health Information:

• Right to Access: You may request access to inspect and obtain copies of your medical records and billing records maintained by Catamount Health. We will provide electronic copies upon request when records are maintained electronically. Requests must be submitted in writing and will be fulfilled within 30 days.
• Right to Amend: If you believe that PHI we maintain about you is inaccurate or incomplete, you may request an amendment in writing. We will respond within 60 days and may deny the request under certain circumstances as permitted by HIPAA, with a written explanation.
• Right to an Accounting of Disclosures: You may request a list of certain disclosures of your PHI that we have made for purposes other than treatment, payment, or healthcare operations during the preceding six years. One accounting per 12-month period is provided at no charge.
• Right to Request Restrictions: You may request that we restrict certain uses and disclosures of your PHI. While we are not required to agree to all such requests, we are required to honor a request to restrict disclosure to a health plan for services you have paid for in full out of pocket.
• Right to Request Confidential Communications: You may request that we communicate with you about health matters in a particular way or at a particular location. We will accommodate reasonable requests.
• Right to a Paper Copy: You may request a paper copy of this Notice at any time, even if you previously received it or agreed to receive it electronically.
• Right to File a Complaint: If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

Data Security Measures

Catamount Health employs comprehensive administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of your health information, consistent with the HIPAA Security Rule and HITECH Act requirements:

• AES-256 encryption for all electronic PHI at rest and in transit.
• Role-based access controls ensuring that staff access only the minimum necessary information required for their job functions.
• Multi-factor authentication for all electronic health record (EHR) system access.
• Annual HIPAA security risk assessments conducted by independent third-party auditors.
• Mandatory workforce privacy and security training upon hire and annually thereafter, with documented attestation.
• Secure, HIPAA-compliant video conferencing platforms for all telehealth appointments.
• Physical safeguards including locked file rooms, badge-controlled access to clinical areas, and secure document destruction procedures.
• Regular vulnerability scanning and penetration testing of information systems.
• Business Associate Agreements (BAAs) executed with all vendors and partners who access PHI on our behalf.

Breach Notification

In the event of a breach of unsecured Protected Health Information, Catamount Health will notify affected individuals without unreasonable delay and in no case later than 60 calendar days following the discovery of the breach, as required by the HITECH Act Breach Notification Rule (45 CFR Part 164, Subpart D). Notification will include a description of the breach, the types of information involved, steps individuals should take to protect themselves, and the remedial actions taken by Catamount Health. Breaches affecting 500 or more individuals will also be reported to the Secretary of the U.S. Department of Health and Human Services and to prominent media outlets serving the affected area, as required by law.

GDPR & CCPA Complementary Protections

While Catamount Health primarily operates under U.S. federal and Vermont state law, we extend certain complementary protections consistent with the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) to all patients, regardless of residency:

• You may request a complete accounting of all personal data we hold about you in a structured, commonly used, machine-readable format.
• You may request deletion of personal data that is not required to be retained by federal or state healthcare regulations.
• We do not engage in automated profiling or algorithmic decision-making that produces legal effects or similarly significant effects on individuals based on personal health data.
• We do not sell personal information, as defined under CCPA Section 1798.140(t), and have not done so in the preceding 12 months.

Contact Our Privacy Officer

If you have questions about this Notice, wish to exercise any of your privacy rights, or believe that your privacy has been violated, please contact our designated Privacy Officer:

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue SW, Washington, DC 20201, by calling 1-877-696-6775, or online at hhs.gov/ocr/privacy/hipaa/complaints.