HIPAA Notice of Privacy Practices

Section 01

Who We Are and This Notice's Purpose

Klinix Capital Insurance Inc. ("KCI," "we," "us," or "our") is a licensed insurance agency. In our role as an intermediary between clients and health insurance carriers, we may receive, handle, or transmit Protected Health Information ("PHI") as defined by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations.

This Notice of Privacy Practices ("NPP") describes how we may use and disclose your PHI, and your rights with respect to that information, when we act as a Business Associate of a covered entity (such as a health insurance carrier or employer-sponsored group health plan).

We are required by law to maintain the privacy and security of your PHI, provide this Notice, and follow the terms of this Notice.

Section 02

When HIPAA Applies to KCI

KCI acts as a Business Associate under HIPAA when we:

• Submit health insurance applications to carriers on your behalf that contain health-related information
• Process or transmit PHI on behalf of a covered health insurance carrier or employer-sponsored group health plan
• Assist with health insurance enrollment that involves health status information

In these circumstances, we handle PHI under a Business Associate Agreement with the covered entity and use and disclose PHI only as permitted by that agreement and applicable HIPAA regulations.

For general inquiries submitted through our website contact form, we ask that you not submit PHI. The contact form is an unencrypted general inquiry channel and is not a HIPAA-compliant channel for transmitting health information.

Section 03

How We May Use and Disclose PHI

— Permitted Uses Without Authorization

As a Business Associate, we may use and disclose PHI as permitted or required by our Business Associate Agreements and HIPAA, including:

• Treatment, Payment, and Healthcare Operations — facilitating health insurance enrollment, processing applications, and servicing policies on your behalf
• As Required by Law — in response to legal process, court orders, regulatory requirements, or law enforcement requests as permitted by HIPAA
• Public Health Activities — as required by applicable public health laws
• Health Oversight — to oversight agencies (such as state departments of insurance) for activities authorized by law
• Business Associates — to our own subcontractors who assist us in processing PHI, under appropriate Business Associate Agreements

— Minimum Necessary Standard

We use and disclose only the minimum amount of PHI necessary to accomplish the purpose for which it is used or disclosed, as required by HIPAA.

Section 04

Uses and Disclosures That Require Your Authorization

We will not use or disclose your PHI for the following purposes without your written authorization:

• Marketing purposes (subject to HIPAA exceptions)
• Sale of PHI
• Most uses and disclosures of psychotherapy notes
• Any other use or disclosure not described in this Notice or otherwise permitted by law

You have the right to revoke any authorization you have given to us at any time, except where we have already taken action in reliance on it.

Section 05

Your Rights Regarding PHI

To the extent we hold PHI about you in a designated record set, you may have the following rights under HIPAA. To exercise these rights, contact us using the information in Section 08.

• Right to Access — request access to PHI we hold about you in a designated record set, subject to HIPAA exceptions
• Right to Request Amendment — request that we amend PHI you believe is inaccurate or incomplete
• Right to an Accounting of Disclosures — request a list of certain disclosures we have made of your PHI
• Right to Request Restrictions — request restrictions on how we use or disclose your PHI, though we are not required to agree to all requests
• Right to Confidential Communications — request that we communicate with you about PHI through alternative means or at alternative locations
• Right to a Paper Copy of This Notice — request a paper copy of this NPP at any time, even if you received it electronically
• Right to Notification of Breach — be notified in the event of a breach of unsecured PHI as required by the HIPAA Breach Notification Rule

Note: As a Business Associate rather than a covered entity, some of these rights are exercised through the covered entity (your health insurance carrier or employer plan sponsor) rather than directly through KCI. We will direct your request to the appropriate covered entity when applicable.

Section 06

Our Obligations

We are required to:

• Maintain the privacy and security of your PHI
• Provide you with this Notice of our duties and privacy practices
• Notify you following a breach of unsecured PHI
• Abide by the terms of this Notice while it is in effect

We reserve the right to change this Notice at any time. Changes will apply to all PHI we hold. We will post the updated Notice on our website and provide a copy upon request.

Section 07

How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights. We will not retaliate against you for filing a complaint.

HHS Office for Civil Rights:
hhs.gov/ocr/privacy/hipaa/complaints/  |  1-800-368-1019

Texas Department of Insurance:
tdi.texas.gov  |  1-800-252-3439

Section 08

Contact Information

For questions about this Notice, to exercise your rights, or to file a complaint with us: