Notice of Privacy Practices (NPP)

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Compress DME is committed to maintaining the privacy and confidentiality of your protected health information (PHI) in strict compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and applicable California state laws, including the California Confidentiality of Medical Information Act (CMIA).

I. Our Legal Duty

We are required by law to maintain the privacy and security of your PHI, provide you with this notice of our legal duties and privacy practices, and notify you following a breach of unsecured PHI. We must follow the terms of the notice currently in effect.

II. Permitted Uses and Disclosures for TPO (Treatment, Payment, and Healthcare Operations)

As a cash-pay program, we use and disclose your medical information without your written authorization for the following purposes:

Treatment: We may share information with your prescribing physician or other healthcare team members to ensure you receive the correct equipment, proper setup instructions, and ongoing care education.
Payment (Cash-Pay Processing): While we do not process, file, or submit claims to Medicare, Medicaid, or private commercial insurers, we use your personal and financial information to process your direct payments, invoices, and transactions securely through QuickBooks and Wix.
Healthcare Operations: We use your PHI to conduct internal quality assessment reviews, evaluate customer satisfaction, coordinate mandatory employee training, and maintain our accreditation standards.

III. Other Permitted or Required Disclosures Without Your Authorization

Required by Law: We will disclose your PHI when required to do so by federal, state, or local law.
Government Access: We must disclose your PHI to the Secretary of the Department of Health and Human Services (HHS) if requested for purposes of investigating or determining our compliance with HIPAA regulations.
Public Health and Safety: We may disclose PHI to authorized public health authorities or federal agencies for purposes such as managing product defects or handling manufacturer equipment recalls.

IV. Disclosures Requiring Your Written Authorization

Any use or disclosure of your PHI outside of Treatment, Payment, or Healthcare Operations (TPO), or as otherwise legally mandated, requires a valid, written authorization signed by you or your legal representative. You may revoke this authorization in writing at any time, except to the extent that we have already taken action in reliance on it.

V. Your Individual Rights Regarding Your PHI

Under HIPAA and the California CMIA, you possess the following rights

Right of Access: You have the right to inspect and obtain electronic or physical copies of the medical and billing records we maintain about you. We will fulfill your request within 15 days under California law.
Right to Request Amendment: If you believe the medical information we have is incorrect or incomplete, you may request in writing that we amend it. We will review and act on your request within 30 days.
Right to an Accounting of Disclosures: You have the right to request a list of certain disclosures we have made of your PHI for purposes other than TPO or those made pursuant to an explicit authorization.
Right to Request Restrictions: You have the right to request that we restrict how we use or disclose your PHI for treatment, payment, or healthcare operations. While we are not required to agree to all restrictions, we will honor reasonable requests where applicable.

VI. Concerns, Questions, or Complaints

If you believe your privacy rights have been violated, or if you have questions regarding this notice, you may file a complaint with us directly by contacting:

Compress DME Compliance Officer

Email: info@compressdme.com