HIPAA Privacy Policy & Notice of Privacy Practices

1. Introduction and Commitment to Privacy

Bound Medical ("Bound Medical," "we," "us," or "our") is committed to protecting the privacy, confidentiality, and security of our patients' personal and medical information.

Bound Medical provides healthcare services through telehealth to patients throughout Texas, including medical weight loss management, GLP-1 treatments, peptide therapies, hormone replacement therapy, and related wellness services.

We recognize that your health information is personal and sensitive. We are committed to safeguarding Protected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and applicable federal and Texas privacy laws.

This Notice explains how we may use and disclose your health information, your rights regarding that information, and our responsibilities for protecting it.

This Notice applies to PHI maintained by Bound Medical and its covered healthcare operations, including authorized healthcare professionals, employees, contractors, and business associates, as applicable.

2. Information We Collect and Protect

Protected Health Information (PHI) includes individually identifiable information relating to your past, present, or future physical or mental health, healthcare services, or payment for healthcare.

Depending on the services you receive, this information may include:

• Full name, date of birth, address, phone number, and email address.
• Medical history, diagnoses, symptoms, and treatment plans.
• Prescription medications and medication history.
• Laboratory results and diagnostic information.
• Weight management information, metabolic health data, and hormone levels.
• Telehealth consultation records and clinical notes.
• Billing, payment, and insurance information, when applicable.
• Communications between you and your healthcare providers.
• Other health-related information necessary to provide medical care.

We collect and maintain this information only as reasonably necessary for legitimate healthcare and business purposes.

3. How We Use and Disclose Your Health Information

HIPAA permits healthcare providers to use and disclose PHI for certain purposes without obtaining separate written authorization.

A. Treatment

We may use or share your PHI to provide, coordinate, or manage your medical care.

Examples include:

• Reviewing your medical history and laboratory results.
• Evaluating your eligibility for medical weight loss, GLP-1 treatments, peptide therapies, or hormone replacement therapy.
• Developing and adjusting personalized treatment plans.
• Coordinating care with prescribing providers, pharmacies, laboratories, and other healthcare professionals.
• Providing follow-up consultations and monitoring treatment progress.

B. Payment

We may use and disclose PHI to process payments for healthcare services.

This may include verifying payment information, processing transactions, managing patient accounts, and collecting amounts owed.

C. Healthcare Operations

We may use and disclose PHI for legitimate healthcare operations, including:

• Quality assurance and improvement.
• Healthcare provider training and credentialing.
• Patient support and administrative services.
• Compliance audits and risk management.
• Maintaining and improving our telehealth services.
• Evaluating patient care and operational performance.

We will apply the HIPAA minimum necessary standard when required.

4. Telehealth Services and Electronic Communications

Bound Medical provides healthcare services remotely through telehealth technology.

We may use electronic systems to facilitate:

• Virtual medical consultations.
• Appointment scheduling and reminders.
• Secure patient intake and medical history forms.
• Electronic prescriptions.
• Laboratory orders and results.
• Follow-up communications and ongoing patient support.

We take reasonable administrative, technical, and physical measures to protect PHI transmitted or maintained electronically.

Email and Text Messaging

Bound Medical may communicate with patients through email, telephone, text messaging, or secure patient communication systems.

These communications may include appointment reminders, scheduling information, administrative notifications, and treatment-related follow-ups.

Standard email and SMS text messaging may not provide the same level of protection as secure healthcare communication platforms.

Where required, we will obtain appropriate patient consent or authorization and comply with applicable privacy and communications laws.

Patients may request alternative confidential communication methods by contacting Bound Medical.

5. Disclosure to Third-Party Service Providers

Bound Medical may work with third-party service providers that assist with healthcare delivery and business operations.

These providers may include:

• Telehealth technology platforms.
• Electronic health record providers.
• Laboratories and pharmacies.
• Appointment scheduling systems.
• Payment processors.
• Healthcare administrative and patient communication providers.
• Technology and data security vendors.

Bound Medical may also coordinate administrative and patient communication services with Elevate Medical Management PLLC, as applicable.

When a third-party provider performs functions involving PHI on our behalf and qualifies as a HIPAA business associate, we require an appropriate Business Associate Agreement (BAA) and applicable safeguards.

We do not authorize business associates to use PHI for unrelated purposes.

6. Other Uses and Disclosures Permitted or Required by Law

We may disclose PHI without separate written authorization when permitted or required by applicable law, including:

• Public health reporting and disease prevention.
• Reporting suspected abuse, neglect, or domestic violence when legally authorized.
• Health oversight activities, audits, and investigations.
• Judicial and administrative proceedings under applicable legal requirements.
• Certain law enforcement purposes.
• Preventing or reducing a serious threat to health or safety.
• Workers' compensation matters, when applicable.
• Organ and tissue donation, when legally appropriate.
• Research activities that satisfy applicable HIPAA requirements.
• Disclosures to coroners, medical examiners, or funeral directors when authorized by law.

We will limit these disclosures in accordance with applicable legal requirements.

7. Uses and Disclosures Requiring Your Written Authorization

For uses and disclosures not otherwise permitted or required by law, Bound Medical will obtain your written authorization.

This includes, where applicable:

• Most uses or disclosures of psychotherapy notes.
• Marketing communications requiring HIPAA authorization.
• The sale of PHI.
• Other disclosures requiring authorization under federal or Texas law.

You may revoke your authorization in writing at any time, except to the extent we have already acted in reliance on that authorization.

Bound Medical will not sell your protected health information to advertisers or data brokers without legally required authorization.

8. Substance Use Disorder Treatment Records

Certain substance use disorder treatment records may be subject to additional federal confidentiality protections under 42 CFR Part 2.

When Bound Medical receives or maintains records protected by Part 2, we will comply with applicable restrictions governing their use, disclosure, redisclosure, and patient consent.

Part 2 records generally may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against a patient without the patient's specific written consent or a qualifying court order and accompanying legal process, as applicable.

Patients may have additional rights regarding the use and disclosure of these records, including restrictions involving fundraising communications.

9. Your Rights Under HIPAA

As a patient, you have certain rights regarding your protected health information.

A. Right to Access Your Medical Records

You have the right to inspect and obtain copies of your medical records and other PHI maintained in a designated record set, subject to limited legal exceptions.

You may request electronic copies when available.

We will respond within the timeframes required by applicable law.

B. Right to Request Corrections

If you believe your medical information is inaccurate or incomplete, you may request an amendment.

We may deny certain requests when permitted by law and will provide an explanation of the denial.

C. Right to Request Restrictions

You may request restrictions on how your PHI is used or disclosed for treatment, payment, or healthcare operations.

We are not required to agree to every restriction.

However, when you pay out of pocket in full for a healthcare service, you generally have the right to request that information about that service not be disclosed to your health plan for payment or healthcare operations, unless disclosure is required by law.

D. Right to Confidential Communications

You may request that we contact you using a particular method or at a specific location.

For example, you may request that we communicate through a designated telephone number or mailing address.

We will accommodate reasonable requests as required by law.

E. Right to an Accounting of Disclosures

You may request an accounting of certain disclosures of your PHI made by Bound Medical, subject to applicable exclusions and limitations.

F. Right to a Paper Copy

You have the right to request a paper copy of this Notice of Privacy Practices, even if you previously agreed to receive it electronically.

G. Right to Receive Breach Notifications

If a breach involving your unsecured PHI occurs, we will provide notification as required by HIPAA and applicable law.

H. Right to File a Complaint

You have the right to file a complaint if you believe your privacy rights have been violated.

Bound Medical will not retaliate against you for exercising your rights or filing a complaint.

10. Security Measures and Protection of PHI

Bound Medical is committed to maintaining appropriate safeguards to protect patient information.

Our privacy and security program is intended to include:

• Administrative, technical, and physical safeguards.
• Access controls limiting PHI to authorized personnel.
• Secure storage and transmission of electronic health information.
• Workforce privacy and security training.
• Risk assessments and security reviews.
• Appropriate business associate agreements.
• Procedures for identifying and responding to suspected privacy or security incidents.
• Secure disposal of patient information when appropriate.

Although we take reasonable measures to safeguard PHI, no electronic system or transmission method can be guaranteed completely secure.

We continually evaluate our safeguards in accordance with applicable legal requirements.

11. Website Privacy and Online Information

When you visit www.boundmed.com, certain information may be collected through website technologies.

This may include browser information, device information, IP addresses, and website usage information.

Not all information collected through a website is necessarily PHI. However, information that identifies an individual and relates to their healthcare may be subject to HIPAA or other privacy protections depending on the circumstances.

Bound Medical will not knowingly disclose PHI to advertising or analytics providers in violation of applicable privacy laws.

Patients should avoid submitting sensitive medical information through general website contact forms unless the form is specifically designated for secure healthcare communication.

Additional information about website data collection practices may be provided in our general Website Privacy Policy.

12. Patient Communications and Appointment Reminders

Bound Medical may contact you regarding:

• Scheduled telehealth consultations.
• Appointment confirmations and reminders.
• Prescription and treatment-related follow-ups.
• Laboratory testing and results.
• Billing or payment matters.
• Healthcare services relevant to your treatment.

Where required by law, we will obtain appropriate consent before sending automated text messages or other regulated communications.

Patients may opt out of nonessential text messages by following applicable opt-out instructions or contacting our office.

Opting out of text messages does not prevent Bound Medical from communicating important healthcare information through other appropriate channels.

13. Our Legal Responsibilities

Bound Medical is required, to the extent applicable under HIPAA, to:

• Maintain the privacy of protected health information.
• Provide patients with notice of our legal duties and privacy practices.
• Follow the terms of the Notice of Privacy Practices currently in effect.
• Implement appropriate safeguards to protect PHI.
• Notify affected individuals of breaches of unsecured PHI when required by law.
• Respect patients' privacy rights under applicable federal and state laws.

We will not use or disclose PHI in a manner inconsistent with applicable law.

14. Changes to This Privacy Policy

Bound Medical reserves the right to revise this HIPAA Privacy Policy and Notice of Privacy Practices as permitted by law.

Revised notices may apply to all PHI we maintain, including information collected before the revision.

When material changes are made, we will update the Notice and make the revised version available on our website.

The effective date will appear at the beginning of the document.

Patients may request the most current version at any time.

15. Complaints and Reporting Privacy Concerns

If you believe your privacy rights have been violated, or if you have concerns regarding the handling of your medical information, you may contact Bound Medical.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR).

Bound Medical will not retaliate against any patient for submitting a privacy complaint.

16. Contact Information

For questions regarding this HIPAA Privacy Policy, requests for medical records, or concerns about the privacy of your information, please contact:

For sensitive medical information, please contact our office to request an appropriate secure communication method.