DirectRxCare and the affiliated professional entities and licensed clinicians who provide care through the platform (together, the "Covered Entities") are required by law to maintain the privacy of your protected health information ("PHI"), to provide you with this Notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect.
Uses and Disclosures That Do Not Require Your Authorization
Treatment
We share PHI with clinicians, licensed compounding pharmacies, laboratories, and other providers involved in your care so they can evaluate you, dispense medication, and coordinate follow-up.
Payment
We use PHI to process your payments, subscriptions, refunds, and, if applicable, claims or receipts for reimbursement.
Health Care Operations
We use PHI for quality assessment, clinician credentialing and review, training, care coordination, business management, and compliance activities.
Business Associates
We disclose PHI to vendors performing services on our behalf — such as hosting, telehealth infrastructure, pharmacy integration, shipping, and messaging providers — under written HIPAA Business Associate Agreements that require them to safeguard your information.
As Required or Permitted by Law
- Public health activities, including reporting adverse drug reactions and communicable diseases.
- Reporting suspected abuse, neglect, or domestic violence.
- Health oversight audits, investigations, licensure, and inspections.
- Judicial and administrative proceedings, subpoenas, and court orders.
- Law enforcement purposes as narrowly permitted by 45 C.F.R. § 164.512(f).
- To avert a serious and imminent threat to the health or safety of you or others.
- Workers' compensation, organ donation, coroners, medical examiners, and funeral directors.
- Specialized government functions, including military and national security activities.
- Research, only with IRB/privacy-board approval or using de-identified data.
Uses and Disclosures That Require Your Written Authorization
- Most uses and disclosures of psychotherapy notes.
- Any use or disclosure of PHI for marketing purposes.
- Any sale of PHI — we do not sell PHI.
- Disclosures to employers, life insurers, or other third parties you designate.
- Any other use or disclosure not described in this Notice. You may revoke an authorization in writing at any time, except to the extent we have already acted on it.
Your Rights Regarding Your Health Information
- Right of access. You may inspect and obtain a copy of your medical record, including an electronic copy, generally within 30 days of your request. We may charge a reasonable, cost-based fee for copies.
- Right to amend. You may request that we correct PHI you believe is inaccurate or incomplete. If we deny your request, we will explain why in writing and you may submit a statement of disagreement.
- Right to an accounting of disclosures. You may request a list of certain disclosures we made in the six years before your request (excluding treatment, payment, and operations disclosures).
- Right to request restrictions. You may ask us to limit how we use or disclose your PHI. We are not required to agree, except that we must honor a request to withhold information from a health plan when you pay out of pocket in full for the service.
- Right to confidential communications. You may ask us to contact you at an alternate address or phone number, or by a specific method. We will accommodate reasonable requests.
- Right to a paper copy of this Notice. Available on request, even if you agreed to receive it electronically.
- Right to breach notification. We will notify you if a breach of your unsecured PHI occurs.
- Right to choose someone to act for you. A personal representative with legal authority may exercise these rights on your behalf.
To exercise any right, email privacy@directrxcare.com or call 1-866-937-0442. Requests to amend, restrict, or revoke an authorization must be submitted in writing.
Our Legal Duties
- We are required by law to protect the privacy and security of your PHI.
- We must notify you promptly if a breach compromises the privacy or security of your PHI.
- We must follow the duties and privacy practices described in this Notice and give you a copy.
- We will not use or share your information other than as described here unless you tell us in writing that we may. If you tell us we may, you may change your mind at any time.
We may change the terms of this Notice at any time, and the new Notice will apply to all PHI we maintain. The current Notice is always posted on this page with its effective date.
Minimum Necessary
Except for treatment disclosures and disclosures you authorize, we limit uses, disclosures, and requests for PHI to the minimum amount necessary to accomplish the intended purpose.
Complaints
If you believe your privacy rights have been violated, contact our Privacy Officer at privacy@directrxcare.com or 1-866-937-0442. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, DC 20201, by calling 1-877-696-6775, or at hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.
State Law
Where the law of the state in which you receive care provides greater privacy protection than HIPAA — including laws governing reproductive health, mental health, substance use disorder, HIV status, and genetic information — we follow the more protective law.