Effective Date: 2026-04-30
We are required by law to maintain the privacy and security of your Protected Health Information (PHI).
1. How We Use and Disclose Your Health Information
Except for narrow situations defined by law, we will use or disclose your PHI without further written authorization only in these three categories:
1.1 Treatment
Example: Nikki Zhang reviews your pulse, tongue, and symptom history to design an acupuncture + herbal plan; your progress is shared with the in-clinic physical therapist for coordinated care.
1.2 Payment
Example: verifying your insurance benefits, submitting service records for reimbursement, sending you a bill.
1.3 Healthcare Operations
Example: internal quality reviews, practitioner credentialing, staff training, operational audits, and sharing the minimum necessary PHI with vetted business associates (such as an EHR vendor) under a HIPAA-compliant Business Associate Agreement.
2. Other Disclosures Permitted by Law
HIPAA permits us to disclose PHI without your authorization in certain situations:
- Public health activities (e.g. communicable disease reporting)
- Reporting victims of abuse, neglect, or domestic violence
- Lawful judicial subpoenas or court orders
- Specified law-enforcement purposes meeting HIPAA criteria
- Coroners, medical examiners, and funeral directors as needed
- Organ donation
- Research approved by an IRB with strict PHI protections
- To avert a serious and imminent threat to you or to public safety
- Specialized military / veterans affairs purposes
- Workers' Compensation as required by law
3. Disclosures Requiring Your Written Authorization
The following require your prior written authorization:
- Most uses or disclosures of psychotherapy notes
- Use of PHI for marketing (except for face-to-face communications and certain de minimis gifts)
- Sale of your PHI
You may revoke an authorization in writing at any time; revocation takes effect when we receive it but does not affect prior disclosures.
4. Your Rights Regarding Your Health Information
| Right | Description | How to Exercise |
|---|---|---|
| Inspect & copy | Inspect and obtain a copy (electronic or paper) of your medical and billing records | Submit a written Access Request to the Privacy Officer; we respond within 30 days |
| Amend | Request corrections to information you believe is inaccurate | Submit a written Amendment Request with the reason |
| Accounting | Request a list of certain disclosures of your PHI we made in the past 6 years (excludes treatment / payment / operations) | Submit a written Accounting Request — first request in any 12-month period is free |
| Request restrictions | Ask us to restrict disclosure of certain PHI to family or insurers (we may decline most requests; if you pay in full out-of-pocket for a service, you may require us not to disclose to your insurer) | Submit a written Restriction Request |
| Confidential communications | Ask us to contact you only by certain means (no voicemail / email only) | Submit a written Communications Preference |
| Complain | File a complaint with us or with HHS OCR; we will not retaliate | See "Filing a Complaint" below |
| Paper copy | You may request a paper copy of this notice even if you received it electronically | Verbal or written request |
5. Breach Notification
If an unauthorized disclosure of your PHI occurs, we will notify you in writing within 60 days in accordance with the HIPAA Breach Notification Rule, and (depending on scope) report to HHS and possibly the local media as required.
6. Our Duties
- Maintain the privacy and security of your PHI as required by law.
- Provide this Notice to all affected patients.
- Abide by the terms of the Notice currently in effect.
- If we change this Notice, post a new version at the front desk and on the website, and request your acknowledgment of receipt at your next visit.
7. Filing a Complaint
If you believe your privacy rights have been violated, you may:
- Complain to our Privacy Officer:
HIPAA Privacy Officer · HealthKey Group Practice Administrator
Address: 139 Centre St #202, New York, NY 10013
Phone: 212-343-9398
Email: privacy@healthkeygroup.com - Complain to the U.S. Department of Health & Human Services Office for Civil Rights (HHS OCR):
www.hhs.gov/ocr/complaints/
Phone: 1-800-368-1019 (voice) or 1-800-537-7697 (TDD)
We will not retaliate against you for filing a complaint.
8. Changes to This Notice
We reserve the right to change the terms of this Notice. The new terms will apply to all PHI we maintain (including PHI created before the change). The new version will be posted at the front desk and on this site under a new effective date.
9. Contact the Privacy Officer
HealthKey Group · HIPAA Privacy Officer
Email: privacy@healthkeygroup.com
Phone: 212-343-9398
Mailing address: 139 Centre St #202, New York, NY 10013
This Notice follows HIPAA's standard requirements adapted to HealthKey's actual operations. For questions about your PHI rights, please contact the Privacy Officer above.