Notice of Privacy Practices.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: September 26, 2026

Hawaii Virtual Care, LLC (“HVC,” “we,” “us,” or “our”) provides virtual intensive outpatient and outpatient mental health and substance use disorder services to adults in the State of Hawaii. This Notice describes how we may use and share your protected health information (“health information”), your rights regarding that information, and our legal duties. It applies to everyone on our team who works with your records, including clinicians, staff, and contractors acting on our behalf.

Some of the information we keep is protected by more than one law. Records of substance use disorder treatment are protected by federal regulations at 42 C.F.R. Part 2 in addition to HIPAA; Section 5 explains those extra protections. Where Hawaii law gives you greater protection than federal law, for example for certain mental health information, we follow the more protective law.

1. Our Duties

We are required by law to maintain the privacy and security of your health information, to give you this Notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect. We will notify you promptly if a breach occurs that may have compromised the privacy or security of your information. We will not use or share your information other than as described here unless you tell us we can in writing, and you may change your mind at any time by letting us know in writing.

2. How We Use and Share Your Health Information

Treatment. We use and share your information to provide and coordinate your care. For example, your therapist and your psychiatric prescriber on our team may discuss your treatment plan, and with the permissions the law requires, we may coordinate with your primary care provider or another treating provider.

Payment. We use and share your information to bill and get paid for the services we provide. For example, we share information with your health plan to verify your benefits, obtain authorization for services, and submit claims.

Health care operations. We use and share your information to run our program, improve care, and contact you when necessary. For example, we review records to evaluate the quality of care, train clinicians, and meet licensing and accreditation requirements.

Appointment reminders and program communications. We may contact you by phone, text message, or email to remind you of sessions or share information about your care. You may ask us to contact you in a different way or at a different place (see Section 6).

Business associates. We work with outside companies that perform services for us, such as our electronic health record, telehealth video platform, and phone and web-form systems. They may receive health information only to do that work, and they are required by written agreement to protect it.

3. Other Ways We May Use or Share Your Information

We are allowed or required to share your information in other ways, usually for purposes that contribute to the public good. We must meet many conditions in the law before we can share your information for these purposes, and for substance use disorder records the stricter rules in Section 5 apply.

• As required by law, including when the U.S. Department of Health and Human Services asks to confirm we are complying with federal privacy law.
• To prevent a serious threat to health or safety, when we believe in good faith that sharing is necessary to prevent or lessen a serious and imminent threat to you, another person, or the public.
• Reporting abuse or neglect, including suspected child abuse or neglect and abuse of a vulnerable adult, as Hawaii law requires.
• Public health and safety, such as reporting certain diseases or adverse reactions to medications.
• Health oversight activities, such as audits, investigations, inspections, and licensing reviews by government agencies.
• Lawsuits and legal actions, in response to a court or administrative order, or in response to a subpoena when the legal requirements for doing so are met.
• Law enforcement, in limited circumstances permitted by law.
• Coroners, medical examiners, and funeral directors, as permitted by law.
• Workers’ compensation claims, as permitted by law.
• Special government functions, such as military, national security, and protective services, as permitted by law.
• Research, when an approved research process protects your privacy.

People involved in your care. Unless you object, we may share information with a family member, friend, or other person you identify who is involved in your care or in paying for it, limited to what is relevant to their involvement. If you are not able to tell us your preference, for example in an emergency, we may share information if we believe it is in your best interest. For substance use disorder records, we will ask for your written consent first.

4. Uses That Require Your Written Authorization

We will not do the following without your written authorization: use or share psychotherapy notes, except in limited circumstances the law allows; use or share your information for marketing; or sell your information. Any other use or disclosure not described in this Notice will be made only with your written authorization. You may revoke an authorization in writing at any time, except to the extent we have already acted on it.

5. Substance Use Disorder Treatment Records (42 C.F.R. Part 2)

If you receive substance use disorder treatment from us, those records have additional federal protection. In general, we may not tell anyone outside our program that you are a patient, or share information identifying you as having a substance use disorder, unless you consent in writing or one of the limited exceptions below applies.

Consent for treatment, payment, and health care operations. You may give a single written consent allowing us to use and share your substance use disorder records for treatment, payment, and health care operations. If you do, those who receive the records may further use and share them as HIPAA permits, except that they may not be used against you in legal proceedings as described below. You may revoke your consent in writing at any time, except to the extent we have already acted on it.

Exceptions that do not require your consent include: communications within our program as needed to provide your care; to medical personnel in a medical emergency; to qualified service organizations that provide services to us under a written agreement; for scientific research, audits, and program evaluations that meet federal requirements; to report suspected child abuse or neglect as Hawaii law requires; to report a crime committed on our premises or against our personnel; and under a court order that meets the requirements of 42 C.F.R. Part 2.

Protection in legal proceedings. Your substance use disorder records, and testimony relaying their content, may not be used or disclosed in any civil, criminal, administrative, or legislative investigation or proceeding against you unless you consent in writing or a court issues an order that meets the requirements of 42 C.F.R. Part 2, after notice and an opportunity to be heard. A subpoena alone is not enough.

Substance use disorder counseling notes, meaning notes a clinician keeps separately from the rest of your record analyzing a counseling session, may not be used or shared without your separate written consent, except as the law specifically allows.

You may report a violation of these regulations to our Privacy Officer or to the Secretary of the U.S. Department of Health and Human Services (see Section 7).

6. Your Rights

When it comes to your health information, you have the right to:

• Get a copy of your records. You may ask to see or get an electronic or paper copy of your medical and billing records. We will provide a copy or a summary, usually within 30 days of your request, and may charge a reasonable, cost-based fee.
• Ask us to correct your records. If you believe information in your record is incorrect or incomplete, you may ask us in writing to correct it. We may say no, but we will tell you why in writing within 60 days.
• Request confidential communications. You may ask us to contact you in a specific way (for example, a particular phone number or email address) or to send mail to a different address. We will agree to all reasonable requests.
• Ask us to limit what we use or share. You may ask us not to use or share certain information for treatment, payment, or operations. We are not required to agree, and we may say no if it would affect your care. If you pay for a service or item out of pocket in full, you may ask us not to share that information with your health plan for payment or operations, and we will agree unless a law requires us to share it.
• Get a list of those we have shared information with. You may ask for a list (an accounting) of the times we have shared your information in the six years before your request, who we shared it with, and why. It will include disclosures other than those for treatment, payment, and health care operations and certain others you asked us to make. We will provide one accounting a year free of charge.
• Get a copy of this Notice. You may ask for a paper copy of this Notice at any time, even if you agreed to receive it electronically.
• Choose someone to act for you. If you have given someone medical power of attorney or someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will confirm the person has this authority before we act.
• File a complaint if you feel your rights have been violated (see Section 7).

To exercise any of these rights, contact our Privacy Officer using the information below.

7. Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer at the address below. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/. We will not retaliate against you for filing a complaint.

8. Changes to This Notice

We may change the terms of this Notice, and the changes will apply to all information we have about you. The new Notice will be available on our website and upon request, and we will post it where it can be seen by clients.

9. Contact Our Privacy Officer

Privacy Officer
Hawaii Virtual Care, LLC
77-6621 Walua Road, Kailua-Kona, HI 96740
Phone: 808.482.6611
Email: chandler@hawaiivirtualcare.com