HIPAA Notice of Privacy Practices

Our Commitment to Your Privacy

WeCare24, Inc. ("WeCare24") is committed to protecting the privacy of your health information. We are required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations to maintain the privacy of Protected Health Information (PHI) and to provide you with this Notice of Privacy Practices.

WeCare24 operates as a Business Associate to covered healthcare entities (such as physicians, clinics, and health systems). In this capacity, we handle PHI on behalf of your healthcare provider in order to deliver our AI-powered Behavioral Health Integration services.

What is Protected Health Information (PHI)?

PHI is any information that identifies you and relates to your past, present, or future physical or mental health condition, the provision of healthcare to you, or payment for healthcare services. This includes information such as your name, date of birth, diagnosis, treatment records, and insurance information when combined with health data.

How We Use and Disclose Your Health Information

As a Business Associate, WeCare24 may use and disclose PHI in the following ways:

Treatment

We may use your health information to support the delivery of behavioral health services, including AI-driven check-ins, symptom monitoring, and care coordination on behalf of your healthcare provider.

Healthcare Operations

We may use PHI for quality improvement, training, auditing, and operational activities necessary to support our healthcare partners in delivering effective care.

Payment

We may use or disclose PHI to facilitate billing and reimbursement activities, including documentation required for Medicare and Medicaid BHI billing codes (CPT 99484, 99492, 99493, 99494).

As Required by Law

We may disclose PHI when required by federal, state, or local law, including to public health authorities, law enforcement, or in response to court orders.

Business Associates

We may share PHI with our own subcontractors and service providers who assist us in delivering services, provided they agree to protect PHI under a Business Associate Agreement.

Uses and Disclosures Requiring Your Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes not described above, including:

• Most uses and disclosures of psychotherapy notes
• Uses and disclosures of PHI for marketing purposes
• Sale of PHI
• Any other use or disclosure not permitted by HIPAA without authorization

You may revoke your authorization at any time in writing, except where we have already acted in reliance on it.

Your Rights Regarding Your Health Information

You have the following rights with respect to your PHI:

• Right to Access: You have the right to inspect and obtain a copy of your PHI maintained by your healthcare provider. Requests should be directed to your provider.
• Right to Amend: You may request that your healthcare provider amend PHI that you believe is inaccurate or incomplete.
• Right to an Accounting of Disclosures: You may request a list of certain disclosures of your PHI made by your provider or their business associates.
• Right to Request Restrictions: You may request restrictions on how your PHI is used or disclosed, though we are not always required to agree.
• Right to Confidential Communications: You may request that communications about your health be sent to you in a specific way or location.
• Right to a Paper Copy of This Notice: You may request a paper copy of this Notice at any time.

Our Security Safeguards

WeCare24 maintains comprehensive administrative, physical, and technical safeguards to protect PHI in accordance with the HIPAA Security Rule. These include:

• End-to-end encryption of PHI in transit and at rest
• Role-based access controls and multi-factor authentication
• Regular risk assessments and security audits
• Employee training on HIPAA compliance and data handling
• Incident response and breach notification procedures
• Business Associate Agreements with all subcontractors handling PHI

Breach Notification

In the event of a breach of unsecured PHI, WeCare24 will notify the affected covered entity in accordance with the HIPAA Breach Notification Rule. The covered entity is responsible for notifying affected individuals, the Department of Health and Human Services (HHS), and, where applicable, the media.

How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with your healthcare provider, with WeCare24, or directly with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.

Changes to This Notice

WeCare24 reserves the right to change this Notice and to make the revised Notice effective for PHI we already maintain. The current Notice will always be available on our website. Material changes will be communicated to our covered entity partners.

Contact Our Privacy Officer