How your health information is used and protected

1. Who this notice covers

Hawaii Virtual Care is a virtual intensive outpatient program in Hawaii. We treat mental health and substance use conditions together, and care is delivered by licensed Hawaii clinicians entirely by video. This notice applies to Hawaii Virtual Care LLC and to every clinician, staff member, trainee, and volunteer who provides care or support through the program. All of them follow the practices described here.

"Health information" in this notice means information that identifies you and relates to your past, present, or future physical or mental health, the care you receive, or payment for that care. The law calls this protected health information, or PHI. It includes what you tell your clinicians, your assessments and check-ins, your treatment plan, session attendance, prescriptions, and billing records — whether written, spoken in a video session, or stored electronically.

2. Our duties to you

Federal law requires us to:

• keep your health information private and secure;
• give you this notice of our legal duties and privacy practices, and follow the notice that is currently in effect;
• tell you promptly if a breach occurs that may have compromised the privacy or security of your information;
• not use or share your information other than as described here unless you tell us in writing that we may. If you give us permission, you may change your mind at any time by telling us in writing.

Where Hawaii law gives you more protection than federal law, we follow the more protective rule.

3. Uses and disclosures that do not need your permission

Federal law lets us use and share your health information for the following purposes without your written authorization. Each example is illustrative, not a complete list.

Treatment

We may use your health information to provide, coordinate, and manage your care, and share it among the clinicians involved in it. For example, your group facilitator, your individual therapist, and a prescribing clinician may review your assessments and session notes so that your care is consistent. With your agreement, we may also share information with an outside provider you are referred to, or with a hospital or emergency department that is treating you.

Payment

We may use and share your health information to bill for your care and to collect payment — for example, to confirm your coverage, obtain prior authorization from your health plan, submit claims, or answer a plan's questions about the services you received. If you pay for a service in full yourself, you may ask us not to share information about that service with your health plan (see Section 6).

Health care operations

We may use and share your health information to run the program and make sure care is safe and effective — for example, to review the quality of care, measure outcomes with the check-ins you complete, train and supervise clinicians, obtain and maintain licenses and accreditation, resolve complaints, and carry out audits, legal, and administrative work.

Appointment reminders and care options

We may contact you to remind you of a scheduled session or check-in, and to tell you about treatment options or health-related services that may benefit you. You may ask us to contact you only in a certain way or at a certain place (see Section 6).

People involved in your care

Unless you object, we may share information that is directly relevant to a family member, close friend, or other person you identify as involved in your care or in paying for it. If you are not able to tell us your preference — for example, in an emergency — we will use our professional judgment and share only what is in your best interest. Part 2 records are not shared this way without your written consent.

Business associates

We work with companies that perform services for us and must handle your information under a written agreement that requires them to protect it — for example, the platform that carries your video sessions, the cloud services that store your records, and billing or claims processors. They may use your information only to perform those services for us.

4. Other uses and disclosures permitted or required by law

We may also use or share your health information without your authorization in these situations, and only to the extent the law allows. Part 2 records are excluded from most of these unless the specific Part 2 exception applies (Section 7).

• As required by law. When federal, state, or local law requires it.
• Public health and safety. To public health authorities for purposes such as preventing or controlling disease, reporting adverse reactions to medications, or reporting suspected abuse or neglect of a child, elder, or dependent adult as the law requires.
• To prevent a serious threat. When necessary to prevent or lessen a serious and imminent threat to your health or safety or that of another person or the public, and only to someone able to help prevent the threat.
• Health oversight. To agencies that oversee the health care system, such as licensing boards, government benefit programs, and auditors, for audits, investigations, inspections, and licensure.
• Legal proceedings. In response to a court or administrative order, or in some cases a subpoena, discovery request, or other lawful process, when the legal requirements for the disclosure are met.
• Law enforcement. In limited circumstances defined by law, such as to comply with a court order or warrant, to identify or locate a suspect or missing person, or to report a crime on our premises or against our staff.
• Coroners, medical examiners, and funeral directors. As needed to carry out their duties.
• Research. For research that has been approved by an institutional review board or privacy board that has established rules to protect your privacy, or when the information has been de-identified.
• Specialized government functions. For military, veterans, national security, protective services, and correctional or custodial purposes as authorized by law.
• Workers' compensation. As authorized by workers' compensation or similar programs that provide benefits for work-related injuries or illness.
• Organ and tissue donation. To organizations that handle procurement, banking, or transplantation, if you are a donor.

5. Uses that require your written authorization

Except as described in this notice, we will not use or share your health information without your written authorization. The following always require it:

• Psychotherapy notes. A clinician's private notes analyzing the contents of a counseling session, kept separate from the rest of your record. With narrow exceptions (for example, use by the clinician who wrote them, supervised training, or our own legal defense), we will not share psychotherapy notes without your authorization.
• Marketing. We will not use your health information to send you marketing communications without your authorization, and we will tell you if we would be paid for doing so. Face-to-face communications and promotional gifts of nominal value are not considered marketing.
• Sale of your health information. We will not sell your health information without your authorization, and any such authorization must state that we would receive payment.
• Any other use or disclosure not described in this notice.

You may revoke an authorization at any time by telling us in writing. Revocation stops future uses and disclosures; it does not undo anything we did while the authorization was in effect.

6. Your rights over your health information

You have the rights below. To exercise any of them, contact the privacy officer listed in Section 10. We may ask you to put a request in writing.

See and get a copy of your record

You can ask to see or get a copy of your health information, including an electronic copy of records we keep electronically. We will respond within 30 days. We may charge a reasonable, cost-based fee for copies. In limited circumstances we may deny part of your request; if so, we will tell you why in writing and how you can ask for a review of that decision.

Ask us to correct your record

If you believe information in your record is incorrect or incomplete, you can ask us to amend it. We will respond within 60 days. We may say no — for example, if the information was not created by us, or if we believe it is accurate and complete — and if we do, we will explain why in writing and how you can add a statement of disagreement to your record.

Get a list of who we have shared your information with

You can ask for an accounting of the disclosures we have made of your health information in the six years before your request. The list will not include disclosures made for treatment, payment, or health care operations, disclosures you authorized, or certain others the law excludes. One list per 12 months is free; we may charge a reasonable, cost-based fee for additional lists and will tell you the cost in advance.

Ask us to limit what we use or share

You can ask us to restrict how we use or share your information for treatment, payment, or operations, or what we share with people involved in your care. We are not required to agree, and we may say no if the restriction would affect your care. There is one exception: if you pay for a service or item out of pocket in full and ask us not to share information about it with your health plan for payment or operations, we must agree unless the law requires the disclosure.

Ask for confidential communications

You can ask us to contact you in a specific way — for example, only by a particular phone number or email, or only at a particular address. We will agree to all reasonable requests.

Be told about a breach

If a breach of unsecured health information affects you, we will notify you in writing without unreasonable delay and no later than 60 days after we discover it.

Get a copy of this notice

You can ask for a paper copy of this notice at any time, even if you agreed to receive it electronically. The current version is always available in the patient portal.

Choose someone to act for you

If you have given someone medical power of attorney or someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will confirm the person has this authority before we act.

File a complaint

If you believe your privacy rights have been violated, you can file a complaint with us or with the U.S. Department of Health and Human Services. Section 8 explains how. We will not retaliate against you for filing a complaint.

7. Substance use treatment records (42 CFR Part 2)

Because we provide substance use treatment, records that identify you as having a substance use disorder, or as seeking or receiving treatment for one, are protected by a federal confidentiality law, 42 U.S.C. § 290dd-2, and its regulations at 42 CFR Part 2. These rules were revised by a final rule published in February 2024 to align more closely with HIPAA, with a compliance date of February 16, 2026. The 2024 rule is reflected here. Where Part 2 is stricter than HIPAA, Part 2 controls.

Your consent is required

Generally, we may not tell anyone outside the program that you attend, or disclose any information identifying you as a person with a substance use disorder, unless you consent in writing or one of the exceptions below applies. This includes disclosures for treatment, payment, and health care operations that HIPAA alone would permit without consent.

Under the 2024 rule, you may give a single written consent that covers all future uses and disclosures of your Part 2 records for treatment, payment, and health care operations. You do not have to give this consent, and refusing will not affect your care with us; it may affect what we can share with your health plan and other providers. You may revoke your consent in writing at any time, except to the extent we have already acted on it.

Your record may be disclosed for treatment, payment, and operations only with that consent. You can give, review, or withdraw it at any time by contacting the privacy officer in Section 10.

Redisclosure is prohibited

Anyone who receives your Part 2 records from us must protect them and may not share them further except as Part 2 allows. Every disclosure we make with your consent is accompanied by a written notice to the recipient to that effect. Under the 2024 rule, a HIPAA-covered provider or health plan that receives your records under a treatment, payment, or operations consent may use and redisclose them as HIPAA permits, but still may not use them against you in a legal proceeding (see below).

Use in legal proceedings

Your Part 2 records, and testimony about them, may not be used or disclosed in any civil, criminal, administrative, or legislative investigation or proceeding against you unless you consent in writing or a court issues an order that meets the specific requirements of Part 2. A subpoena alone is not enough.

Exceptions that do not require your consent

• Medical emergency. To medical personnel who need the information to treat a condition that poses an immediate threat to your health, when consent cannot be obtained in time.
• Internal communications. Among our own clinicians and staff who need the information to provide your care or run the program.
• Audit and evaluation. To qualified organizations, government agencies, or accrediting bodies that audit or evaluate the program, under Part 2's confidentiality safeguards.
• Research. To researchers, when the strict conditions of Part 2 and, where applicable, HIPAA are met.
• Court order. Under a court order issued after the procedures in Part 2 are followed, and only to the extent the order allows.
• Crimes on our premises or against our staff. To report a crime, or a threat to commit a crime, committed on program premises or against program personnel.
• Child abuse or neglect. To report suspected child abuse or neglect as state law requires. The report may not be used as a basis for further disclosure of your records.
• Public health. To a public health authority, in a form that does not identify you.
• Business associates and contractors. To entities that perform services for the program under a written agreement that binds them to Part 2.

Substance use counseling notes

A clinician's private notes analyzing a counseling session, kept separate from the rest of your record, are treated like psychotherapy notes under HIPAA. They require a separate, specific written consent to be disclosed and are not covered by a general treatment, payment, and operations consent.

Your additional rights under Part 2

• The 2024 rule gives you the right to an accounting of disclosures of your Part 2 records made for treatment, payment, and health care operations under your consent, covering the three years before your request. That right takes effect when the federal government finalizes the related HIPAA accounting rule.
• You may ask us to restrict disclosures of your Part 2 records to your health plan in the same way as described in Section 6.
• Breach notification rules apply to Part 2 records in the same way as to other health information.
• You may file a complaint about a Part 2 violation with us or with the U.S. Department of Health and Human Services (Section 8). We will not retaliate against you for filing one. Violations of Part 2 are subject to the same civil and criminal penalties as violations of HIPAA.

8. Complaints

If you believe your privacy rights have been violated, or that we have not followed this notice, you may complain to us, to the federal government, or both. We will not retaliate against you, deny you care, or treat you differently because you filed a complaint.

9. Changes to this notice

We may change this notice and our privacy practices at any time. Any change will apply to all the health information we hold about you, including information we collected before the change. When we make a material change, we will post the new notice in the patient portal and make it available at your next session or on request. The effective date of the current version appears at the top of this page.

10. Contact

Questions about this notice, requests to exercise your rights, and consent forms all go to the privacy officer.

If you are in crisis, call or text 988 — the Suicide and Crisis Lifeline is available 24 hours a day.