Privacy Policy

Effective Date: November 24, 2025 | Last Updated: November 24, 2025

At Red Earth Clinic, we are committed to protecting your privacy and maintaining the confidentiality of your protected health information (PHI). This Privacy Policy explains how we collect, use, disclose, and safeguard your information in compliance with the Health Insurance Portability and Accountability Act (HIPAA) and other applicable laws.

HIPAA Notice of Privacy Practices

Information We Collect

Protected Health Information (PHI)

We collect information necessary to provide quality healthcare services, including:

• Personal identifiers: Name, address, phone number, email, date of birth
• Health information: Medical history, symptoms, diagnoses, treatment plans, medications
• Insurance information: Insurance provider, policy numbers, billing information
• Treatment records: Clinical notes, acupuncture charts, herbal prescriptions, progress notes
• Payment information: Credit card details, billing history (processed securely through encrypted systems)

Website Information

When you visit our website, we may collect:

• Browser type and device information
• IP address and location data
• Pages visited and time spent on site
• Referral source (how you found our site)
• Information submitted through contact forms

How We Use Your Information

Treatment

We use your PHI to:

• Provide, coordinate, and manage your healthcare
• Create and maintain treatment plans
• Prescribe herbs and recommend lifestyle modifications
• Communicate with other healthcare providers (with your consent)
• Monitor your progress and adjust treatments accordingly

Payment

We use your information to:

• Process payments and handle billing
• Submit insurance claims on your behalf
• Respond to insurance inquiries
• Collect outstanding balances

Healthcare Operations

We may use your information for:

• Quality assessment and improvement activities
• Training and education of staff
• Business planning and development
• General administrative purposes

When We May Disclose Your Information

With Your Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes other than treatment, payment, or healthcare operations, including:

• Releasing records to family members or friends
• Sharing information with other healthcare providers
• Marketing communications
• Sale of PHI (which we never do)

Without Your Authorization

Federal law allows or requires us to disclose your information without authorization in certain situations:

• Public health activities: Reporting communicable diseases as required by law
• Legal proceedings: In response to court orders or subpoenas
• Law enforcement: When required by law or to prevent serious threats
• Health oversight: To government agencies for audits, investigations, or inspections
• Worker's compensation: For work-related injuries or illnesses
• Serious threats: To prevent or lessen a serious threat to health or safety

How We Protect Your Information

We implement comprehensive security measures to protect your PHI:

Physical Safeguards

• Secure facility with controlled access
• Locked file cabinets for paper records
• Secure disposal of confidential information
• Private treatment rooms

Technical Safeguards

• Encrypted electronic health records system
• Secure, password-protected networks
• Regular software updates and security patches
• Automatic logoff after periods of inactivity
• Regular data backups

Administrative Safeguards

• Staff training on HIPAA compliance
• Access restrictions based on role and need
• Written policies and procedures
• Regular security risk assessments
• Business associate agreements with all vendors

Website Privacy & Cookies

Cookies and Tracking

Our website uses cookies to:

• Remember your preferences
• Analyze website traffic and usage patterns
• Improve user experience
• Enable certain website features

You can control cookies through your browser settings. Note that disabling cookies may limit website functionality.

Third-Party Services

We use the following third-party services that may collect information:

• Google Analytics: Website traffic analysis (anonymized data)
• Go High Level: Customer relationship management (HIPAA-compliant)
• Payment processors: Secure payment processing (PCI-compliant)

All third-party service providers are required to maintain HIPAA compliance through signed Business Associate Agreements.

Your Choices and Controls

Accessing Your Records

You have the right to review and obtain copies of your health records. To request access:

• Submit a written request to our Privacy Officer
• We will respond within 30 days
• Copies may be provided electronically or on paper
• Reasonable copying fees may apply

Requesting Amendments

If you believe information in your records is incorrect or incomplete, you may request an amendment:

• Submit a written request explaining the change
• We will respond within 60 days
• We may deny the request if the information is accurate and complete
• You may submit a statement of disagreement

Restricting Uses and Disclosures

You may request restrictions on how we use or disclose your PHI. We are not required to agree to your request but will consider it carefully.

Confidential Communications

You may request that we communicate with you in a specific way (e.g., cell phone instead of home phone) or at a specific location. We will accommodate reasonable requests.

Email Communications

While we use secure, encrypted email for communications containing PHI, standard email is not secure. By providing your email address, you consent to receiving appointment reminders and general information via email. You may opt out of email communications at any time.

Breach Notification

In the unlikely event of a breach of your unsecured PHI, we will notify you in accordance with federal law. Notification will include:

• Description of what happened
• Types of information involved
• Steps you should take to protect yourself
• What we are doing in response
• Contact information for questions

Children's Privacy

Our website is not directed to individuals under 18. We do not knowingly collect personal information from children online. Parents or legal guardians must provide consent for minors' treatment, and all PHI for minors is handled in accordance with applicable laws regarding parental access to health records.

Changes to This Privacy Policy

We reserve the right to revise this Privacy Policy at any time. Changes will be effective immediately upon posting to our website. The revised policy will apply to all PHI we maintain, including information created or received before the changes. We will provide notice of material changes by:

• Posting the updated policy on our website
• Making copies available at our clinic
• Notifying you at your next appointment

Filing a Complaint

If you believe your privacy rights have been violated, you may file a complaint with:

You will not be penalized or retaliated against for filing a complaint.

This Privacy Policy is provided in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, 45 CFR Parts 160 and 164. A printed copy of this notice is available upon request at our clinic.