HIPAA NOTICE OF PRIVACY PRACTICES

This Notice describes how your medical information may be used and disclosed, and how you can access your information. Please review it carefully.
If you have questions, contact us at compliance@aviaryhealth.com.

Our Responsibilities

This Notice describes how Recora, Inc d/b/a Aviary Health (“Aviary Health”) may use and disclose your Protected Health Information (“PHI”) in connection with the Services when acting primarily as a business associate on behalf of a Partner Program and, only where expressly applicable, as a HIPAA covered entity or health care provider.

‍

“Aviary” refers to the technology platform, software, workflows, and related digital tools used to support such services. Partner Programs and other healthcare providers remain responsible for their own notices of privacy practices. If you receive clinical services from a Partner Program or other provider, that provider’s notice also applies to your PHI.

‍

Where Aviary Health acts solely as a business associate on behalf of a Partner Program or other covered entity, this Notice is intended to supplement, and not replace, the applicable covered entity’s notice of privacy practices.

‍

This Notice applies only to PHI handled by Recora, Inc. through Aviary Health and/or Aviary in connection with HIPAA-regulated services. It does not apply to information processed outside HIPAA contexts, which is described in the Privacy Policy and, where applicable,in Partner Program notices.

• maintain the privacy and security of PHI that we create, receive, maintain, or transmit;
• notify the applicable covered entity, and where applicable notify you, in the event of a breach involving unsecured PHI, as required by law;
• provide you with this Notice where required or otherwise make it available to you;
• follow the terms of the Notice currently in effect, to the extent applicable to our role; and
• provide access to PHI,including electronic copies where applicable, directly or through the applicable covered entity, as required by law and our contractual obligations.

We may change the terms of this Notice at any time. Updates will be posted on our website and can be requested in paper or electronic form.

How We May Use and Disclose Your PHI Without Written Authorization

For Treatment

We may use and disclose PHI, as permitted by law and applicable agreements, to support treatment activities of the applicable Partner Program or provider, including care coordination, conveying program-related information, facilitating communications authorized by the applicable provider or Partner Program, and supporting related program operations.

For Payment

We may use and disclose PHI, as permitted by law and applicable agreements, to support payment-related activities, including claims, billing, eligibility, and coverage determinations.

For Health Care Operations

We may use and disclose PHI, as permitted by law and applicable agreements, to support health care operations of the applicable Partner Program, covered entity, or Aviary Health program operations, including quality improvement, safety, training, accreditation, auditing, compliance,documentation, and customer support.

To Vendors or Subcontractors‍‍

We may share PHI with vendors and subcontractors that perform services for us or for the applicable Partner Program (for example,technology, hosting, support, analytics, or billing), provided they are required by law and contract to protect PHI.

With Family and Friends Involved in Your Care

Unless you object, and as permitted by law and applicable agreements or as directed by the applicable Partner Program or provider, we may share relevant PHI with a family member, friend, or other person you identify who is involved in your care or payment.

For Health Oversight‍

We may disclose PHI to oversight agencies for audits,investigations, inspections, and other activities authorized by law.

For Legal and Law Enforcement Purposes‍

We may disclose PHI in response to a court order or other lawful process, and to law enforcement as permitted by law.

As Required by Law

We will disclose PHI when required by federal, state,or local law.

To Prevent a Serious Threat

We may use or disclose PHI to prevent or lessen a serious and foreseeable threat to health or safety, consistent with applicable law.

For Public Health and Safety

We may disclose PHI for public health activities and reporting, and for organ and tissue donation, as permitted by law.

Workers’ Compensation

We may disclose PHI for workers’ compensation or similar programs, as permitted by law.

Coroners, Medical Examiners, and Funeral Directors

We may disclose PHI to these officials as permitted by law.

For Research

We may use or disclose PHI for research as permitted by law, including with appropriate review/approval or where allowed without authorization.

Your Rights Regarding Your PHI

Depending on our role and the applicable Partner Program relationship, you may have the following rights under HIPAA and related federal rules. These rights may be exercised directly with us or through the applicable Partner Program or other covered entity, and we may coordinate with that entity to respond.

Right to Access and Obtain a Copy‍

We, or the applicable Partner Program or other covered entity, will act on your request no later than 30 days after receipt of the request, as required by law. If we cannot provide access within 30 days, we may take one additional 30-day extension. If we take an extension, we will notify you in writing within the initial 30 days, explain the reason for the delay,and provide the date by which we will respond. We may charge a reasonable,cost-based fee as permitted by law, and we will tell you the expected fee in advance.

Right to Fee Transparency‍

You may ask for an estimate of any permitted fees before you request copies or access.

Right to Request Amendments‍

You may ask us, or the applicable Partner Program or other covered entity, to correct or update your PHI if you believe it is incorrect or incomplete.

Right to Request Restrictions‍

You may ask us, or the applicable Partner Program or other covered entity, to limit certain uses or disclosures of your PHI, and we will consider your request as required by law.

Right to Confidential Communications‍

You may ask us, or the applicable Partner Program or other covered entity, to contact you in a specific way (for example, by mail or at a particular phone number).

Right to an Accounting of Disclosures‍

You may request a list of certain disclosures of your PHI made in the past six years, as permitted by law.

Right to Be Notified of a Breach‍

You have the right to be notified if a breach of your unsecured PHI occurs.

Right to a Paper or Electronic Copy of This Notice‍

You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.

‍

You may submit requests directly to us atcompliance@aviaryhealth.com or to your Partner Program or other provider. In some cases, particularly where Aviary Health acts only as a business associate,we may direct your request to the applicable Partner Program or provider, or coordinate with them to respond.
‍

To exercise any of these rights, contact us at compliance@aviaryhealth.com. We may ask you to submit your request in writing, and we will respond within the time required by law.

Other Uses and Disclosures

We will obtain your written authorization for uses/disclosures not described in this Notice when required by law,including most marketing and any sale of PHI. You may revoke this authorization at any time in writing.

Questions or Complaints

If you believe your rights have been violated or wish to file a complaint:

Contact us at compliance@aviaryhealth.com.

File a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), within 180 days of when you knew that the act or omission occurred. OCR may extend this time limit for good cause. Recora, Inc and its Aviary and Aviary Health brands will not retaliate against you for filing a complaint.

‍