Privacy Policy

HIPAA & TEXAS MEDICAL PRIVACY ACT COMPLIANCE POLICY

1. PURPOSE

The purpose of this policy is to ensure that KDI Health, LLC (“KDI Health”) complies with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), including the Privacy Rule, Security Rule, and Breach Notification Rule, as well as the Texas Medical Records Privacy Act (Texas Health & Safety Code Chapter 181) and related Texas privacy laws.

This policy establishes standards for safeguarding the confidentiality, integrity, and availability of Protected Health Information (PHI).

2. SCOPE

This policy applies to:

• All workforce members of KDI Health, LLC, including employees, physicians, contractors, and volunteers
• All forms of PHI, including electronic, paper, and oral information
• All systems, devices, applications, and records used to create, receive, maintain, or transmit PHI

3. GOVERNING LAW

This policy is governed by:

• HIPAA (45 CFR Parts 160 and 164)
• Texas Medical Records Privacy Act (Texas Health & Safety Code Chapter 181)
• Texas Business & Commerce Code Chapter 521

Where Texas law provides greater privacy protection than HIPAA, Texas law controls.

4. DEFINITIONS

• Protected Health Information (PHI): Individually identifiable health information relating to a patient’s past, present, or future physical or mental health, treatment, or payment.
• Electronic PHI (ePHI): PHI maintained or transmitted electronically.
• Workforce Member: Any person whose conduct is under the direct control of KDI Health.
• Minimum Necessary: Limiting access to PHI to the minimum amount needed to perform job duties.
• Sensitive Personal Information: As defined under Texas law, including medical information and identifying data.

5. DESIGNATED PRIVACY & SECURITY OFFICER

KDI Health, LLC designates the following individual as its Privacy and Security Officer:

Dr. Stephen Gasper
Privacy & Security Officer
KDI Health, LLC
9555 Lebanon Rd., Suite 501
Frisco, TX 75035

The Privacy & Security Officer is responsible for:

• Oversight of HIPAA and Texas Medical Privacy Act compliance
• Workforce training and education
• Investigation and mitigation of privacy incidents
• Breach risk assessment and notification
• Responding to patient privacy complaints
• Liaison with regulatory authorities, including HHS and the Texas Attorney General

6. USE AND DISCLOSURE OF PHI

KDI Health may use or disclose PHI without patient authorization for:

• Treatment
• Payment
• Healthcare operations
• As required by law

All other uses or disclosures of PHI require valid written authorization unless otherwise permitted by law.

7. MINIMUM NECESSARY STANDARD

KDI Health limits the use, disclosure, and access to PHI to the minimum necessary to accomplish the intended purpose. Access to PHI is role-based and reviewed periodically.

8. PATIENT RIGHTS

Patients have the right to:

• Access and obtain copies of their medical records
• Request amendments to their records
• Receive an accounting of disclosures
• Request restrictions on certain uses or disclosures
• Request confidential communications
• File complaints without retaliation

Requests must be submitted in writing and will be processed within required legal timeframes.

9. SAFEGUARDS

A. Administrative Safeguards

• HIPAA and Texas privacy training within 60 days of hire
• Retraining at least every two years
• Sanction policy for violations
• Business Associate Agreements (BAAs) with applicable vendors

B. Physical Safeguards

• Controlled facility access
• Secure storage of paper records
• Screen privacy measures
• Visitor access controls

C. Technical Safeguards

• Unique user identification
• Secure authentication procedures
• Encryption where applicable
• Audit logs and monitoring
• Secure data backup procedures

10. BUSINESS ASSOCIATES

KDI Health maintains written Business Associate Agreements with all vendors who create, receive, maintain, or transmit PHI on its behalf. Business Associates are required to comply with HIPAA and Texas privacy laws.

11. BREACH NOTIFICATION

A breach is any unauthorized access, use, or disclosure of PHI.

In the event of a suspected breach:

1. Immediate containment and investigation
2. Risk assessment conducted by the Privacy Officer
3. Notification to affected individuals without unreasonable delay
4. Notification to HHS and the Texas Attorney General when required
5. Documentation retained for at least six (6) years

12. TRAINING REQUIREMENTS

All workforce members must:

• Complete HIPAA and Texas privacy training within 60 days of hire
• Complete refresher training at least every two years
• Acknowledge understanding of privacy obligations

Training records are maintained by KDI Health.

13. SANCTIONS

Violations of this policy may result in:

• Disciplinary action up to and including termination
• Civil or criminal penalties under federal or Texas law

14. DOCUMENT RETENTION

HIPAA-related documentation, including policies, training records, complaints, and breach documentation, is retained for a minimum of six (6) years.

15. NON-RETALIATION

KDI Health strictly prohibits retaliation against any individual who reports a privacy concern or exercises privacy rights in good faith.

POLICY REVIEW

This policy is reviewed at least annually and updated as necessary to reflect regulatory or operational changes.

Approved By:

Dr. Stephen Gasper
Privacy & Security Officer