Notice of Privacy Practices

This Notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

1. About this notice

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires health care providers who conduct certain electronic transactions to notify patients of their privacy practices. This Notice of Privacy Practices ("Notice") describes how Solenta Wellness ("we," "us," or "the practice") may use and disclose your protected health information (PHI) and explains your rights regarding that information.

We are required by law to maintain the privacy of your PHI, provide you with this Notice of our legal duties and privacy practices, and follow the terms of the Notice currently in effect.

2. Information we collect

In the course of providing medical cannabis evaluation and recommendation services, we may collect the following types of information:

• Your name, date of birth, address, phone number, and email address
• Medical history, current symptoms, diagnoses, and treatment information
• Medications you are currently taking
• Records from other health care providers that you authorize us to obtain
• Information related to your medical cannabis recommendation and state application
• Payment and billing information

This website does not collect protected health information. The website is informational only. All patient information is collected, stored, and managed through our HIPAA-compliant electronic health record system (SimplePractice) and HIPAA-compliant communications platform (Spruce Health), not through this website.

3. How we use and disclose your health information

We may use and disclose your PHI for the following purposes:

Treatment

We use your health information to provide, coordinate, and manage your care. This includes conducting your evaluation, making clinical decisions about whether a medical cannabis recommendation is appropriate, and communicating with other providers involved in your care when you authorize us to do so.

Payment

We may use your health information as needed to obtain payment for services. As a cash-pay practice, this is generally limited to processing your payment and providing itemized receipts on request.

Health care operations

We may use your health information for activities necessary to operate our practice, including quality assessment, staff training, compliance activities, and business management.

State Electronic Verification System (EVS) reporting

If we issue a medical cannabis recommendation, we are required by Utah law to submit your certification through the state's Electronic Verification System (EVS), operated by the Utah Department of Health and Human Services. This submission includes your identifying information and recommendation details as required by the Utah Medical Cannabis Act.

Other required or permitted disclosures

We may disclose your PHI without your authorization when required or permitted by law, including:

• Public health activities — as required by state or federal public health authorities
• Law enforcement — when required by a court order, subpoena, or other legal process, or as otherwise required by law
• Health oversight — to a health oversight agency for activities authorized by law, such as audits and investigations
• Abuse or neglect reporting — as required by Utah law
• To avert a serious threat — when necessary to prevent a serious and imminent threat to your health or safety or that of others
• Workers' compensation — as authorized by workers' compensation laws
• Coroners, medical examiners, and funeral directors — as required by law

For any use or disclosure not described in this Notice, we will request your written authorization before disclosing your PHI.

4. Your rights as a patient

Under HIPAA, you have the following rights regarding your health information:

Right to access

You have the right to inspect and obtain a copy of your health information maintained by this practice. Requests must be submitted in writing. We may charge a reasonable, cost-based fee for copies.

Right to request amendment

If you believe that information in your records is incorrect or incomplete, you may request an amendment. We may deny the request under certain circumstances, but we will provide a written explanation if we do.

Right to an accounting of disclosures

You have the right to request a list of certain disclosures we have made of your health information. This accounting does not include disclosures made for treatment, payment, or health care operations, or disclosures you authorized in writing.

Right to request restrictions

You may request that we restrict how we use or disclose your health information for treatment, payment, or health care operations. We are not required to agree to your request, except that we must agree to restrict disclosures to a health plan for services you paid for entirely out of pocket.

Right to confidential communications

You may request that we communicate with you about health matters in a certain way or at a certain location. For example, you may ask that we contact you only by phone rather than by email. We will accommodate reasonable requests.

Right to a paper copy of this notice

You have the right to receive a paper copy of this Notice upon request, even if you have agreed to receive it electronically.

Right to file a complaint

If you believe your privacy rights have been violated, you may file a complaint with our practice or with the U.S. Department of Health and Human Services Office for Civil Rights (see Section 9 below). We will not retaliate against you for filing a complaint.

5. Our responsibilities

• We are required by law to maintain the privacy and security of your protected health information.
• We are required to provide you with this Notice of our legal duties and privacy practices with respect to your health information.
• We are required to abide by the terms of this Notice currently in effect.
• We are required to notify you if a breach of your unsecured protected health information occurs.

6. State-specific notes

Utah law may provide additional protections for certain types of health information beyond what HIPAA requires. Where Utah law is more restrictive than HIPAA, we follow the more restrictive standard. This includes:

• Utah's Health Data Authority Act, which governs certain uses of health data
• Protections specific to the Utah Medical Cannabis Act and the confidentiality of patient and provider information within the state medical cannabis program
• Utah law regarding the disclosure of records related to substance abuse treatment

7. Changes to this notice

We reserve the right to change the terms of this Notice at any time. Any changes will apply to all information we already have about you as well as information we receive in the future. The revised Notice will be available at our office, on this website, and provided to you upon request.

8. Contact for privacy questions

If you have questions about this Notice or about our privacy practices, contact our Privacy Officer:

Solenta Wellness, Privacy Officer
Solenta Wellness
532 E 800 N #10, Orem, UT 84097
Phone: 385-334-4800
Email: contact@solentawellness.com

9. How to file a complaint

If you believe your privacy rights have been violated, you may file a complaint with:

Our practice

Contact our Privacy Officer using the information in Section 8 above. All complaints will be investigated and you will not be penalized for filing a complaint.

U.S. Department of Health and Human Services

You may also file a complaint with the Office for Civil Rights:

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Room 509F, HHH Building
Washington, D.C. 20201
Phone: (800) 368-1019
TDD: (800) 537-7697

You may also file a complaint online at ocrportal.hhs.gov (opens in a new tab).