HIPAA Notice of Privacy Practices

Our commitment to your privacy

Oklahoma Cannabis Clinic is a covered health care provider under the Health Insurance Portability and Accountability Act (HIPAA). We are required by law to maintain the privacy and security of your protected health information (PHI), to give you this notice of our legal duties and privacy practices, to follow the terms of the notice currently in effect, and to notify you if a breach occurs that may have compromised the privacy or security of your information.

PHI includes information that identifies you and relates to your health, your care or payment for your care, such as your intake questionnaire, visit notes, physician recommendation and billing records.

How we may use and disclose your health information

For treatment

Our physicians use your information to evaluate you and prepare your recommendation. With your permission or as permitted by law, we may share information with other providers involved in your care.

For payment

We use limited information to process your evaluation fee through our payment processor, including authorization holds, charges and refunds. We do not bill health insurance.

For health care operations

We may use information to run our practice, such as quality review, physician oversight, training, compliance and customer support.

With service providers (business associates)

We share information with vendors that help us operate, such as our telehealth, scheduling, records and payment platforms. They must sign business associate agreements that require them to protect your information.

Appointment reminders and follow-up

We may contact you by email, text or phone about appointments, your OMMA application checklist and renewal reminders. You can opt out of non-essential messages at any time.

Other uses and disclosures allowed or required by law

We may use or share your information without your written authorization in these situations, as permitted by HIPAA and Oklahoma law:

• As required by law, including state or federal requirements
• To the Oklahoma Medical Marijuana Authority when needed to verify a physician recommendation or comply with OMMA rules
• Public health and safety, such as preventing a serious threat to health or safety, or reporting suspected abuse or neglect
• Health oversight, such as audits and inspections by licensing boards
• Legal proceedings, in response to a court order, subpoena or other lawful process
• Law enforcement, in limited circumstances allowed by law
• Coroners and medical examiners, as required
• Government functions, such as specialized government functions permitted by law

Uses that require your written permission

We will not use or share your information for any other purpose without your written authorization, including:

• Marketing purposes
• Selling your information (we never sell patient information)
• Sharing with dispensaries, growers, product brands or advertisers
• Most sharing of psychotherapy notes

You may revoke an authorization in writing at any time, except to the extent we have already relied on it.

Your rights

• Get a copy of your records. You can request an electronic or paper copy of your medical and billing records. We'll provide it, usually within 30 days, and may charge a reasonable, cost-based fee.
• Ask us to correct your records. If you believe information is incorrect or incomplete, you can ask us to amend it. We may say no, but we'll explain why in writing within 60 days.
• Request confidential communications. You can ask us to contact you in a specific way, such as at a different email or phone number. We'll say yes to reasonable requests.
• Ask us to limit what we use or share. We aren't required to agree, but we'll consider every request. If you pay for a service in full out of pocket, you can ask us not to share that information with your health insurer, and we'll agree unless the law requires otherwise.
• Get a list of disclosures. You can ask for a list of times we've shared your information in the six years before your request, with certain exceptions such as treatment, payment and operations.
• Get a copy of this notice. You can ask for a paper copy at any time, even if you agreed to receive it electronically.
• Choose someone to act for you. A legal guardian or person with medical power of attorney can exercise your rights. For minor patients, a parent or legal guardian generally exercises these rights.

How we protect your information

Video visits take place on a HIPAA-compliant, encrypted platform, and phone visits are conducted privately by your physician. We use encryption in transit, role-based access controls, audit logs and secure record storage. Staff receive privacy and security training. Payment card numbers are handled by a PCI-compliant processor, and we never store your full card number.

Breach notification

If a breach of unsecured protected health information affects you, we will notify you as required by law, without unreasonable delay and no later than 60 days after we discover it.

Complaints

If you believe your privacy rights have been violated, you can file a complaint with our Privacy Officer using the contact details below. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by mail at 200 Independence Avenue SW, Washington, D.C. 20201, by phone at 1-877-696-6775, or online at hhs.gov/ocr/complaints. We will not retaliate against you for filing a complaint.

Contact our Privacy Officer

Privacy Officer
Oklahoma Cannabis Clinic
83121 S Western Ave, Suite 197, Oklahoma City, OK 73139
Email: care@oklahomacannabisclinic.com

Changes to this notice

We may change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available on this page, and a copy will be available on request.

See also our website privacy policy, which covers information collected through this website.