Privacy Policy and Notice of Privacy Practices

1. Notice of Privacy Practices

Your Information. Your Rights. Our Responsibilities.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, HOW YOU CAN GET ACCESS TO THIS INFORMATION, AND YOUR RIGHTS CONCERNING YOUR HEALTH INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices applies to protected health information created, received, maintained, or transmitted by Terrain Medical.

Federal law, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), establishes privacy protections for protected health information. Florida law may provide additional protections in some circumstances. When Florida or another applicable law provides greater protection than HIPAA, Terrain Medical follows the more protective requirement.

Your rights

You have the following rights concerning your health information.

Access your records

You may ask to inspect or obtain an electronic or paper copy of medical records and other health information about you that we maintain and that is available to you under applicable law.

We generally provide access within 30 days of receiving a qualifying request, or sooner when applicable law requires. If a lawful extension is necessary, we will notify you in writing.

Any fee for providing records will be limited to what applicable law permits.

Request a correction

You may ask us to amend health information that you believe is incorrect or incomplete.

We generally respond within 60 days. If a lawful extension is necessary, we will notify you in writing.

We may deny an amendment request in circumstances permitted by law. If we do, we will explain the reason in writing and describe any rights you have to submit a statement of disagreement.

Request confidential communications

You may ask us to communicate with you in a particular way or at a particular location, such as using a particular telephone number, mailing address, or other communication method.

We will accommodate reasonable requests as required by law.

Ask us to limit what we use or share

You may ask us not to use or disclose certain health information for treatment, payment, or healthcare operations.

We are not required to agree to every requested restriction. If we agree, we will follow the restriction except when disclosure is otherwise permitted or required by law, including when information may be necessary for emergency treatment.

If you pay for a healthcare item or service completely out of pocket and ask us not to disclose information about that item or service to your health plan for payment or healthcare operations, we will honor that request when required by law unless disclosure is otherwise required by law.

Request an accounting of disclosures

You may ask for an accounting of certain disclosures of your health information made during the six years before your request.

The accounting generally does not include disclosures made for treatment, payment, or healthcare operations and certain other disclosures excluded by law, including disclosures that you authorized.

The first accounting in a 12-month period will be provided without charge. Additional accountings during the same period may involve a reasonable, permitted fee that we disclose to you in advance.

Receive a copy of this notice

You may ask for a paper copy of this Notice of Privacy Practices at any time, even if you previously received or agreed to receive it electronically.

Have someone act for you

If a person has legal authority to act as your personal representative, that person may exercise applicable privacy rights on your behalf.

We may require documentation and verification of the person’s authority before allowing that person to act for you.

Additional rules may apply to parents, guardians, minors, persons who independently consent to particular healthcare services, and situations involving suspected abuse, neglect, or endangerment.

File a complaint

If you believe Terrain Medical has violated your privacy rights, you may file a complaint with us by contacting the Privacy Officer listed at the end of this policy.

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights:

HHS Office for Civil Rights complaint portal

Terrain Medical will not retaliate against you for making a privacy complaint or exercising a privacy right.

Your choices

For certain health information, you may tell us your preferences about how information is shared.

For example, you may tell us whether and how we may share relevant information with:

• family members;
• friends;
• caregivers;
• other people involved in your care or payment for your care; or
• persons assisting during a disaster or emergency.

If you cannot tell us your preference, we may disclose information when permitted by law and when, in our professional judgment, the disclosure is in your best interests or is necessary to prevent or lessen a serious and imminent threat to health or safety.

Uses requiring written authorization

We obtain written authorization when required by law, including for:

• marketing uses or disclosures that require authorization;
• a sale of protected health information that requires authorization; and
• most uses and disclosures of psychotherapy notes.

Florida’s additional requirements concerning the use of patient information for solicitation or marketing also apply.

Other uses and disclosures not permitted by this notice or applicable law require your written authorization.

You may revoke an authorization by notifying Terrain Medical in writing. Revocation applies prospectively and does not undo actions already taken in reliance on a valid authorization.

If we contact you for fundraising, you may tell us not to contact you again.

If Terrain Medical maintains substance use disorder patient records protected by 42 CFR Part 2, we will provide any advance notice and choice required by law before using those records for fundraising communications.

How we may use and disclose your medical information

We may use or disclose medical information when permitted or required by applicable law.

Treatment

We may use your health information to evaluate, diagnose, and treat you.

We may disclose relevant information to physicians, laboratories, pharmacies, imaging facilities, specialists, hospitals, or other professionals involved in your care when permitted by law.

For example, we may send an order to a laboratory, send an electronic prescription to your pharmacy, or provide relevant clinical information to another healthcare professional involved in your treatment.

With your permission when required, Terrain Medical may also coordinate with an acupuncturist, therapist, or other practitioner involved in your care.

Payment and prescription coverage

Terrain Medical generally does not submit health-insurance claims for professional services covered by its Direct Primary Care Membership Agreement.

We may use information to:

• administer membership fees and other authorized charges;
• process payments;
• maintain billing records;
• answer billing questions; and
• address prescription coverage or medication prior-authorization requirements.

When necessary for a prescription prior authorization, we may transmit relevant medical information through CoverMyMeds or another permitted service to your health plan, pharmacy benefit manager, pharmacy, or another entity involved in determining prescription coverage.

Independent laboratories, pharmacies, imaging facilities, specialists, hospitals, and other healthcare providers may bill you or your health plan separately under their own policies.

Healthcare operations

We may use or disclose health information as permitted by law to operate the practice and improve care.

Examples include:

• quality review;
• compliance activities;
• care coordination;
• maintaining medical records;
• operating secure technology systems;
• credentialing and professional review;
• legal and regulatory compliance;
• business planning; and
• other healthcare operations permitted by law.

Other permitted or required disclosures

Subject to applicable legal requirements, we may use or disclose health information for purposes including:

• public-health activities, including required disease reporting, product recalls, and adverse-event reporting;
• reporting suspected abuse, neglect, exploitation, or domestic violence;
• preventing or lessening a serious and imminent threat to health or safety;
• health-oversight activities, including licensing reviews, audits, inspections, and investigations;
• workers’ compensation matters;
• lawful law-enforcement requests;
• judicial and administrative proceedings when applicable legal requirements are satisfied;
• authorized military, national-security, protective-service, or other special government functions;
• organ and tissue donation;
• activities of coroners, medical examiners, and funeral directors;
• research when applicable authorization, consent, waiver, and confidentiality requirements are satisfied;
• disclosures required by federal or state law; and
• disclosures to the U.S. Department of Health and Human Services when required to determine Terrain Medical’s compliance with federal privacy law.

The fact that HIPAA permits a disclosure does not necessarily mean Florida law or another applicable law permits it. When another law imposes greater restrictions, those restrictions also apply.

Information with additional legal protections

Substance use disorder patient records

To the extent Terrain Medical has substance use disorder patient records protected by 42 CFR Part 2, additional federal confidentiality protections apply.

Records protected by 42 CFR Part 2, and testimony conveying their contents, will not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you without either your qualifying written consent or a qualifying court order accompanied by a subpoena or other legal requirement compelling disclosure.

Other Part 2 restrictions and patient rights also apply when Terrain Medical possesses records subject to that law.

Florida medical-record protections

Terrain Medical follows applicable Florida confidentiality requirements in addition to HIPAA.

Florida medical records generally may not be furnished to, or a patient’s medical condition discussed with, persons other than the patient, the patient’s legal representative, or healthcare practitioners and providers involved in the patient’s care or treatment, except with appropriate written authorization or when another legal exception applies.

A disclosure permitted under HIPAA is not automatically permitted under Florida law.

HIV information

HIV test information is subject to additional confidentiality requirements under Florida law.

We disclose HIV test results or identifying information only when authorized by a legally effective release or when a specific legal exception permits or requires disclosure.

DNA analysis information

DNA-analysis results protected by Florida law are treated as confidential and are disclosed only with legally sufficient consent or as otherwise permitted by applicable law.

Minors

Some healthcare services may legally be obtained by a minor without parental consent.

When Florida law gives a minor independent confidentiality rights concerning those services, including certain sexually transmitted infection services, Terrain Medical follows those requirements when handling records, communications, and disclosures.

Parental access to other records is governed by HIPAA, Florida law, and the circumstances of the patient’s care.

Mental-health and other specially protected information

Mental-health records, psychotherapy notes, substance use disorder records, HIV information, genetic or DNA information, and other categories of information may be subject to additional federal or Florida confidentiality requirements.

Terrain Medical applies those additional protections when they apply.

Patient information used for marketing

Florida law restricts the use of patient information for solicitation or marketing of goods or services without the required specific written release or authorization.

Terrain Medical obtains authorization when required before using patient medical information for such purposes.

Clinical technology and service providers

Terrain Medical uses outside technology and service providers to support medical care and practice operations.

When a provider handles protected health information on behalf of Terrain Medical and HIPAA requires a Business Associate Agreement, Terrain Medical requires an appropriate agreement or other legally sufficient arrangement.

Cerbo

Terrain Medical uses Cerbo for:

• new-patient clinical intake;
• medical records;
• clinical appointment scheduling; and
• electronic prescribing.

Clinical information intended for Terrain Medical should be submitted through the clinical systems or communication methods provided by the practice rather than through the public website.

Spruce

Terrain Medical uses Spruce for secure patient messaging and communications associated with patient care.

Patients should use the communication instructions provided by Terrain Medical when sending clinical or sensitive information.

CoverMyMeds

Terrain Medical may use CoverMyMeds to submit and manage prescription prior-authorization requests.

These requests may require the transmission of information such as:

• patient identifying information;
• prescribed medication information;
• diagnosis or clinical information;
• treatment history;
• information requested by a health plan or pharmacy benefit manager; and
• other information reasonably necessary to process the authorization request.

We disclose only information permitted by applicable law for these purposes.

Other healthcare providers

Laboratories, pharmacies, imaging centers, specialists, hospitals, and other independent healthcare providers may maintain medical information under their own privacy practices and legal obligations.

Their separate privacy notices do not change Terrain Medical’s responsibilities concerning information maintained by Terrain Medical.

Recording and AI-assisted documentation

Visiting terrain.md, scheduling an introduction call, or becoming a member does not by itself authorize Terrain Medical to record a clinical encounter or use an AI-assisted documentation tool during your care.

When separate consent is legally or operationally required for recording or AI-assisted documentation, Terrain Medical obtains that consent separately.

Our responsibilities

Terrain Medical is required by law to maintain the privacy and security of protected health information, provide you with notice of our legal duties and privacy practices concerning protected health information, and follow the terms of the Notice of Privacy Practices currently in effect.

We maintain reasonable administrative, technical, and physical safeguards designed to protect health information.

No electronic system can guarantee absolute security.

If a breach of unsecured protected health information occurs, Terrain Medical will provide required notifications to affected individuals and governmental authorities as required by applicable law.

We will not use or disclose protected health information other than as described in this notice or otherwise permitted or required by law unless you provide a legally sufficient authorization.

If you give us written authorization, you may generally revoke it in writing for future uses and disclosures.

Changes to this Notice of Privacy Practices

Terrain Medical may change the terms of this Notice of Privacy Practices as permitted by law.

Changes may apply to health information we already maintain as well as information received after the revised notice takes effect.

When this notice is materially revised, Terrain Medical will make the current version available as required by law, including on terrain.md.

You may request a paper copy at any time.

3. Retention

Terrain Medical retains information for the purposes described in this policy and as necessary to comply with applicable medical-record, legal, regulatory, security, accounting, and business requirements.

Retention periods vary depending on:

• the type of information;
• why it was collected;
• whether it forms part of the medical record;
• legal retention requirements;
• security or audit requirements; and
• obligations imposed by agreements with service providers.

Medical records may be required to be retained after a patient stops receiving care from Terrain Medical.

Technical logs, security records, analytics data, communications, and backups may have different retention periods.

Service providers may also retain information according to applicable contracts, legal requirements, and their own documented retention practices.

When information is no longer required for a legitimate purpose and no legal retention obligation applies, Terrain Medical takes reasonable steps to dispose of it securely.

Deleting a cookie, closing a browser, or deleting a communication does not necessarily immediately remove corresponding information from operational logs or backups.

5. Privacy Contact

For questions about this Privacy Policy, requests concerning your information, or complaints concerning Terrain Medical’s privacy practices, contact:

Please keep sensitive medical details out of your initial ordinary email. Terrain Medical can arrange an appropriate method for receiving supporting medical information.