Privacy Policy & HIPAA Notice

1. Introduction

EnnHealth Psychiatry ("EnnHealth," "we," "us," or "our") is committed to protecting the privacy and security of your personal and health information. This Privacy Policy and Notice of Privacy Practices describes how we collect, use, disclose, and safeguard your information in accordance with the Health Insurance Portability and Accountability Act (HIPAA), state privacy laws, and other applicable regulations.

By using our services, scheduling appointments, or accessing our website at ennhealth.com, you acknowledge that you have read and understand this Privacy Policy.

2. Protected Health Information (PHI)

Protected Health Information (PHI) includes any individually identifiable health information we create, receive, maintain, or transmit in connection with your care. This includes:

• Your name, date of birth, address, email, and phone number
• Medical history, diagnoses, and treatment plans
• Medication prescriptions and management records
• Insurance and billing information
• Appointment records and clinical notes
• Telehealth session recordings (if applicable, with consent)
• Communications between you and your provider

3. How We Use Your Information

For Treatment

We use your PHI to provide, coordinate, and manage your psychiatric care. This includes conducting evaluations, prescribing medications, providing therapy, and coordinating with other healthcare providers involved in your care.

For Payment

We may use and disclose your PHI to bill and collect payment for services. This includes submitting claims to your health insurance, verifying coverage, and processing Direct Psychiatry Care (DPC) membership payments.

For Healthcare Operations

We may use your PHI for quality improvement, staff training, compliance audits, and business management necessary to operate our practice.

With Your Authorization

Other uses and disclosures of your PHI not described in this notice will be made only with your written authorization. You may revoke any authorization at any time in writing.

4. Disclosures Without Authorization

We may disclose your PHI without your authorization in limited circumstances required or permitted by law:

• Public health activities: Reporting communicable diseases, adverse events, or abuse
• Legal proceedings: In response to a court order or lawful subpoena
• Law enforcement: To comply with legal mandates or to prevent serious threats
• Imminent threat: If we believe disclosure is necessary to prevent serious and imminent harm to you or others
• Workers' compensation: As required by workers' compensation laws
• Coroners and funeral directors: As necessary for their duties
• Military and veterans: As required by military command authorities

5. Your Rights Under HIPAA

You have the following rights regarding your PHI:

• Right to Access: You may request copies of your medical records. We will provide them within 30 days of your request.
• Right to Amend: You may request corrections to your records if you believe they contain errors.
• Right to Restrict: You may request restrictions on how we use or disclose your PHI, though we are not required to agree to all restrictions.
• Right to Confidential Communications: You may request that we contact you at a specific phone number, address, or email.
• Right to an Accounting of Disclosures: You may request a list of certain disclosures we have made of your PHI.
• Right to a Copy of This Notice: You may request a paper or electronic copy of this notice at any time.
• Right to Revoke Authorization: You may revoke any previously given authorization in writing.
• Right to File a Complaint: You may file a complaint with us or with the U.S. Department of Health and Human Services if you believe your privacy rights have been violated.

6. Website & Digital Privacy

Information We Collect Online

When you visit ennhealth.com or use our booking system, we may collect:

• Information you provide through forms (name, email, phone, date of birth, insurance)
• Appointment booking data
• Browser type, IP address, and device information
• Pages visited and time spent on our website

Cookies & Analytics

We may use cookies and analytics tools to improve our website experience. These do not collect PHI. You may disable cookies through your browser settings.

Third-Party Services

Our website integrates with the following services:

• Google Calendar: For appointment scheduling and availability
• Google Apps Script: For booking form processing
• Email services: For appointment confirmations and notifications

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

7. Telehealth Privacy

All telehealth sessions are conducted via HIPAA-compliant, encrypted video platforms. We take the following precautions:

• End-to-end encryption for all video sessions
• Secure, password-protected provider accounts
• Sessions are not recorded without explicit patient consent
• We recommend patients use a private, secure location during sessions

8. Data Security

We implement administrative, technical, and physical safeguards to protect your information, including:

• Encrypted data transmission (SSL/TLS)
• Access controls and role-based permissions
• Regular security assessments and staff training
• Secure disposal of records when retention periods expire
• Business Associate Agreements (BAAs) with all third-party vendors who access PHI

9. Data Retention

We retain medical records in accordance with Florida state law and federal requirements:

• Adult records: Minimum 7 years from last patient encounter
• Minor records: Until the patient reaches age 25 or 7 years from last encounter, whichever is longer
• Billing records: Minimum 7 years

10. Breach Notification

In the event of a breach of unsecured PHI, we will notify affected individuals within 60 days of discovery, as required by the HITECH Act. If the breach affects more than 500 individuals, we will also notify the U.S. Department of Health and Human Services and local media.

11. Children's Privacy

We do not knowingly collect personal information from children under 13 without parental consent. For patients under 18, a parent or legal guardian must provide consent for treatment and authorize any disclosures.

12. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. Changes will be posted on this page with an updated effective date. Continued use of our services after changes constitutes acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your HIPAA rights, or need to file a complaint:

EnnHealth Psychiatry
Privacy Officer
1230 Okaley Seaver Dr, Suite 101
Clermont, FL 34711
Phone: (407) 796-2406
Email: contact@ennhealth.com

You may also file a complaint with:
U.S. Department of Health and Human Services
Office for Civil Rights
Website: hhs.gov/ocr/complaints