Our Commitment
Epix TRX and the licensed physicians in our clinical network ("we," "us," "our") are required by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") to maintain the privacy of your Protected Health Information ("PHI"), provide you with this Notice of our legal duties and privacy practices, and abide by the terms of the Notice currently in effect.
Uses and Disclosures of PHI
Treatment
We use and disclose your PHI to provide, coordinate, or manage your healthcare. For example, your physician may share information with the compounding pharmacy fulfilling your prescription or with a lab processing your tests.
Payment
We use and disclose your PHI to obtain payment for services, including verifying coverage and processing billing.
Healthcare Operations
We use PHI for quality assessment, provider review, training, accreditation, and general administrative functions.
Other Permitted Uses and Disclosures
- As required by law (e.g., subpoenas, court orders, public health reporting)
- To prevent a serious threat to health or safety
- For law enforcement purposes when permitted by HIPAA
- To organ procurement organizations
- For workers' compensation claims as authorized by law
Uses Requiring Your Authorization
Most uses and disclosures of psychotherapy notes, marketing communications, and any sale of PHI require your written authorization. You may revoke an authorization at any time in writing.
Your Rights Under HIPAA
- Right to Inspect and Copy: You have the right to inspect and obtain a copy of your PHI.
- Right to Amend: You may request amendments to your PHI if you believe it is incorrect or incomplete.
- Right to an Accounting of Disclosures: You may request a list of certain disclosures we have made of your PHI.
- Right to Request Restrictions: You may request restrictions on certain uses and disclosures of your PHI.
- Right to Confidential Communications: You may request that we contact you in a specific way or location.
- Right to a Paper Copy of This Notice: You may request a paper copy at any time.
- Right to Be Notified of a Breach: You will be notified following a breach of unsecured PHI.
Our Safeguards
- End-to-end encryption of PHI in transit (TLS 1.2+) and at rest (AES-256)
- Multi-factor authentication for all clinical and administrative staff
- Role-based access controls and audit logging
- Business Associate Agreements with all vendors handling PHI
- Regular HIPAA training for workforce members
- Annual third-party security risk assessments
Complaints
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer at team@epixtrx.com or with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr. We will not retaliate against you for filing a complaint.
Changes to This Notice
We reserve the right to change this Notice and apply revised terms to all PHI we maintain. Updated notices will be posted on our website and made available upon request.
Contact
Privacy Officer
Epix TRX
Austin, Texas
team@epixtrx.com