Notice of Privacy Practices

Our Commitment to Your Privacy

Blue Skies MD LLC DBA Lumora MD (Lumora MD) and its affiliated licensed healthcare providers (collectively, "we," "us," or "our") are committed to protecting your health information. We are required by law to maintain the privacy of protected health information ("PHI"), to provide you with this Notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect.

This Notice applies to all records relating to your care that are created or retained by Lumora MD and its affiliated providers. It covers both electronic and paper records, including information collected through our telehealth platform and patient portal.

How We May Use and Disclose Your Health Information

The following categories describe the ways we may use and disclose your PHI. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted or required to use and disclose information will fall within one of the categories.

Treatment

We may use your PHI to provide, coordinate, or manage your healthcare and related services. For example, we may disclose your PHI to a licensed physician affiliated with our platform so they can provide you with a telehealth consultation, or to a pharmacy to fulfill a prescription your provider has written. We may also share your health information with other providers involved in your care.

Payment

Because our Services operate on a cash-pay basis, we generally do not use or disclose PHI for insurance billing purposes. However, we may use PHI to process your payment, verify your financial information, and send you billing communications. If you choose to seek reimbursement from your insurer independently, we may provide you with documentation of services rendered at your request.

Healthcare Operations

We may use and disclose your PHI for healthcare operations, which include quality assessment and improvement activities, reviewing provider performance, licensing and accreditation activities, training programs, conducting or arranging for other business activities, and business management and general administrative activities.

Appointment Reminders and Treatment Alternatives

We may use and disclose PHI to contact you as a reminder about appointments or follow-up consultations. We may also use your PHI to tell you about treatment alternatives or other health-related benefits and services that may be of interest to you.

Uses and Disclosures Required by Law

We will disclose PHI about you when required to do so by federal, state, or local law. This includes disclosures to state licensing boards, law enforcement where legally required, and mandatory reporting obligations.

Public Health Activities

We may disclose your PHI for public health activities permitted or required by law, including: reporting of communicable diseases to public health authorities; reporting abuse, neglect, or domestic violence to appropriate authorities; reporting reactions to medications or problems with products; notifying people who may have been exposed to a communicable disease; and notifying appropriate government authorities when we reasonably believe you have been a victim of abuse, neglect, or domestic violence.

Health Oversight Activities

We may disclose PHI to health oversight agencies for activities authorized by law, including audits, investigations, inspections, and licensure.

Judicial and Administrative Proceedings

We may disclose PHI in the course of judicial or administrative proceedings, including in response to a court order, subpoena, discovery request, or other lawful process.

Law Enforcement

We may disclose PHI for law enforcement purposes as required by law or in response to a valid law enforcement request, including to identify or locate a suspect, fugitive, material witness, or missing person; to report certain types of wounds or injuries; or to alert law enforcement of a crime that occurred on our premises.

Serious Threat to Health or Safety

We may use and disclose PHI when necessary to prevent a serious and imminent threat to the health or safety of a person or the public, and when the disclosure is to someone reasonably able to prevent or lessen the threat.

Business Associates

We may disclose PHI to third-party "business associates" that perform services on our behalf (such as billing, data storage, platform infrastructure, or analytics). We require all business associates to enter into a Business Associate Agreement (BAA) that requires them to protect the privacy and security of your PHI.

Organized Healthcare Arrangement

Lumora MD may operate as part of an organized healthcare arrangement (OHCA) with affiliated professional entities. PHI may be shared among participants in the OHCA for treatment, payment, and healthcare operations purposes.

Uses and Disclosures Requiring Your Authorization

Other uses and disclosures of your PHI not covered by this Notice or required by law will be made only with your written authorization. If you authorize us to use or disclose PHI, you may revoke that authorization in writing at any time. Your revocation will not affect any use or disclosure that occurred prior to revocation.

The following uses and disclosures will always require your written authorization:

• Uses and disclosures of psychotherapy notes (where applicable).
• Uses and disclosures of PHI for marketing purposes.
• Sale of PHI.
• Most uses and disclosures of PHI for research purposes.
• Uses or disclosures not otherwise permitted by this Notice or applicable law.

Your Rights Regarding Your Health Information

You have the following rights with respect to your PHI. To exercise any of these rights, submit a written request to privacy@lumoramd.com.

Right to Access

You have the right to inspect and obtain a copy of the PHI that may be used to make decisions about your care. We will provide you with a copy within 30 days (or as otherwise required by applicable law). We may charge a reasonable cost-based fee for the preparation and delivery of copies.

Right to Request Amendment

If you believe that PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept. We may deny your request if the information was not created by us, is not part of the information we keep, is not part of the information you would be permitted to inspect, or if we determine the record is accurate and complete.

Right to an Accounting of Disclosures

You have the right to request a list of disclosures we have made of your PHI during the six years prior to your request (or as required by applicable law). This accounting does not include disclosures for treatment, payment, and healthcare operations.

Right to Request Restrictions

You have the right to request restrictions on certain uses and disclosures of your PHI. We are not required to agree to your request unless the request is for restriction of disclosure to a health plan for a service that you paid for in full out of pocket, in which case we are required to comply.

Right to Request Confidential Communications

You may request that we communicate with you about healthcare matters in a specific way or at a specific location (for example, by email only or at a particular address). We will accommodate reasonable requests.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice at any time, even if you have agreed to receive it electronically. You may request a paper copy by contacting us at privacy@lumoramd.com.

Right to Be Notified of a Breach

You have the right to be notified in the event of a breach of unsecured PHI affecting you, as required by the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414) and applicable state law.

Our Duties

We are required by law to maintain the privacy of your PHI, to provide you with this Notice of our duties and privacy practices, and to notify you following a breach of your unsecured PHI. We are required to abide by the terms of this Notice as currently in effect.

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have about you as well as any information we receive in the future. We will post the current Notice on our website and make it available upon request.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights.

To file a complaint with us, contact:
Privacy Officer Keith Swider at privacy@lumoramd.com

To file a complaint with the Office for Civil Rights:
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W., Washington, D.C. 20201
Phone: 1-877-696-6775 | Website: www.hhs.gov/ocr/privacy/hipaa/complaints

We will not retaliate against you for filing a complaint.

How to Contact Us

For questions about this Notice or to exercise any of your rights, please contact:

Privacy Officer: Keith Swider at privacy@lumoramd.com
1320 State Route 702 E
Roy, WA 98580